Moderate Kernel Security Update: Addressing Vulnerabilities in AlmaLinux Kernel Packages
Summary
ALSA-2025:21931: Moderate: kernel security update. Affects kernel versions < 6.12.0-124.13.1.el10_1. Fixed in 6.12.0-124.13.1.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kernel is the core component of any Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. AlmaLinux, a community-driven enterprise-grade Linux distribution, relies on the kernel for stability and performance. The kernel packages in AlmaLinux include various modules and functionalities, which are critical for system operations. However, vulnerabilities in the kernel can pose significant risks, potentially leading to unauthorized access or system instability.
Vulnerability Detail
This vulnerability arises from inadequate bounds checking in the NFS filehandle conversion function, nfs_fh_to_dentry(), which could allow an attacker to exploit this weakness to gain unauthorized access to system resources. Additionally, a flaw in the TCP stack related to the fast open request handling could lead to potential denial of service or data corruption. These vulnerabilities, identified as CVE-2025-39730 and CVE-2025-39955, highlight the importance of maintaining robust security measures in kernel operations.
How To Fix
Minimum fixed version
6.12.0-124.13.1.el10_1
This is the first release that contains the fix.
sudo dnf update kernelTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit access to NFS shares and disable TCP fast open if not required. This can be done by modifying the NFS server configuration and adjusting TCP settings in the system network configuration.
Conclusion
In summary, the kernel vulnerabilities identified in AlmaLinux pose moderate risks that can be mitigated through timely updates. Users are encouraged to update their kernel packages to the latest version to ensure system security and stability. Utilizing tools like Vulert can further enhance monitoring and alerting for open-source vulnerabilities.
See every vulnerability recorded for kernel →
FAQ
The update addresses two vulnerabilities: CVE-2025-39730, which involves inadequate bounds checking in NFS, and CVE-2025-39955, which relates to improper handling of TCP fast open requests.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading a manifest file like package-lock.json, Vulert can alert you in real-time about any vulnerabilities affecting your application.
Yes, temporarily limiting access to NFS shares and disabling TCP fast open can help mitigate the risks until the system is updated.
You can update the kernel by running 'sudo dnf update kernel' in your terminal.
Detailed information about the vulnerabilities can be found on the CVE pages for CVE-2025-39730 and CVE-2025-39955, as well as through the AlmaLinux advisories.
Related vulnerabilities
Recent vulnerabilities recorded for kernel.
