Critical Security Update for Kernel Package in Rocky Linux 9: Multiple Vulnerabilities Addressed
Summary
RLSA-2025:4341: Important: kernel security update. Affects kernel versions < 0:5.14.0-503.40.1.el9_5. Fixed in 0:5.14.0-503.40.1.el9_5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kernel package is a fundamental component of any Linux operating system, serving as the core interface between the hardware and software. It manages system resources, facilitates communication between hardware and software, and ensures system stability and security. The kernel is crucial for the overall performance and functionality of the operating system, making it a prime target for vulnerabilities that can affect system integrity and security.
Vulnerability Detail
The kernel vulnerabilities identified include CVE-2024-42292, which involves an out-of-bounds access within the zap_modalias_env() function, potentially leading to unauthorized access or system crashes. CVE-2024-42322 addresses improper dereferencing in the ip_vs_add_service function, which could allow for denial of service attacks. CVE-2024-44990 highlights a null pointer dereference in bond_ipsec_offload_ok, risking system stability. CVE-2024-46826 pertains to a double read issue in kernel.randomize_va_space, which may expose sensitive data. Lastly, CVE-2025-21927 concerns potential memory corruption in nvme_tcp_recv_pdu(), which could lead to data loss or system instability. The cumulative CVSS score for these vulnerabilities is 8.0, indicating a high severity level.
How To Fix
Minimum fixed version
0:5.14.0-503.40.1.el9_5
This is the first release that contains the fix.
sudo dnf update kernelTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users may consider disabling specific kernel features or services that are known to be affected by these vulnerabilities. However, this is not a permanent solution and should only be used until the kernel can be updated.
Conclusion
In summary, the kernel package in Rocky Linux 9 has several critical vulnerabilities that need to be addressed promptly. Updating to the patched version is essential to maintain system security and integrity. Users are encouraged to take immediate action to mitigate potential risks associated with these vulnerabilities.
See every vulnerability recorded for kernel →
FAQ
The kernel package is the core component of the Linux operating system, responsible for managing hardware and software interactions.
These vulnerabilities can lead to unauthorized access, system crashes, denial of service, data loss, and overall instability of the operating system.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Delaying the update can expose your system to significant risks, including potential data breaches and system failures. It is highly recommended to update as soon as possible.
The CVSS score for these vulnerabilities is 8.0, indicating a high severity level that requires immediate attention.
References
Related vulnerabilities
Recent vulnerabilities recorded for kernel.
