Kernel-RT Security Update: Addressing NFS Race Condition and i40e Validation Issues
Summary
ALSA-2025:21920: Moderate: kernel-rt security update. Affects kernel-rt versions < 4.18.0-553.85.1.rt7.426.el8_10. Fixed in 4.18.0-553.85.1.rt7.426.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kernel-rt package provides the Real Time Linux Kernel, designed for systems requiring high determinism. It enhances performance for time-sensitive applications, making it critical in environments where timing is paramount. However, like any software, it is susceptible to vulnerabilities that can compromise system integrity and security.
Vulnerability Detail
This vulnerability arises from two specific issues within the kernel-rt packages. The first issue involves a race condition when updating an existing write in NFS (CVE-2025-39697), which could potentially allow unauthorized access or data corruption. The second issue pertains to improper index validation in the i40e configuration queues message (CVE-2025-39971), which could lead to system instability or crashes. Both vulnerabilities pose moderate risks, necessitating prompt attention to maintain system security.
How To Fix
Minimum fixed version
4.18.0-553.85.1.rt7.426.el8_10
This is the first release that contains the fix.
sudo dnf update kernel-rtTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds have been provided for these vulnerabilities. The best course of action is to apply the security update as soon as possible.
Conclusion
In summary, the kernel-rt security update addresses critical vulnerabilities that could affect system integrity and performance. It is crucial to apply the provided patches promptly to safeguard your systems against potential threats.
See every vulnerability recorded for kernel-rt →
FAQ
The update addresses a race condition in NFS and improper index validation in i40e configuration queues.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
Failure to apply the update may leave your system vulnerable to unauthorized access and potential instability.
Yes, the NFS race condition could potentially lead to data corruption or loss if exploited.
It is advisable to regularly check for updates, especially after security advisories are released.
Related vulnerabilities
Recent vulnerabilities recorded for kernel-rt.
