RHSA-2025:8342HighCVSS 7.8

Red Hat Security Advisory: kpatch-patch-5_14_0-427_13_1, kpatch-patch-5_14_0-427_31_1, kpatch-patch-5_14_0-427_44_1, and kpatch-patch-5_14_0-427_55_1 security update

Published
June 2, 2025
Last Modified
August 4, 2026

🔗 CVE IDs covered (2)

CVE-2024-53141 →CVE-2025-21756 →

📋 Description

CVE-2024-53141 — kernel: netfilter: ipset: add missing range check in bitmap_ip_uadt CVE-2025-21756 — kernel: vsock: Keep the binding until socket destruction

🎯 Affected products29

  • Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • kpatch-patch-5_14_0-427_13_1-0:1-9.el9_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • kpatch-patch-5_14_0-427_13_1-0:1-9.el9_4.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • kpatch-patch-5_14_0-427_13_1-0:1-9.el9_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • kpatch-patch-5_14_0-427_13_1-debuginfo-0:1-9.el9_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • kpatch-patch-5_14_0-427_13_1-debuginfo-0:1-9.el9_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • kpatch-patch-5_14_0-427_13_1-debugsource-0:1-9.el9_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • kpatch-patch-5_14_0-427_13_1-debugsource-0:1-9.el9_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • kpatch-patch-5_14_0-427_31_1-0:1-7.el9_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • kpatch-patch-5_14_0-427_31_1-0:1-7.el9_4.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • kpatch-patch-5_14_0-427_31_1-0:1-7.el9_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • kpatch-patch-5_14_0-427_31_1-debuginfo-0:1-7.el9_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • kpatch-patch-5_14_0-427_31_1-debuginfo-0:1-7.el9_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • kpatch-patch-5_14_0-427_31_1-debugsource-0:1-7.el9_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • kpatch-patch-5_14_0-427_31_1-debugsource-0:1-7.el9_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • kpatch-patch-5_14_0-427_44_1-0:1-5.el9_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • kpatch-patch-5_14_0-427_44_1-0:1-5.el9_4.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • kpatch-patch-5_14_0-427_44_1-0:1-5.el9_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • kpatch-patch-5_14_0-427_44_1-debuginfo-0:1-5.el9_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • kpatch-patch-5_14_0-427_44_1-debuginfo-0:1-5.el9_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • kpatch-patch-5_14_0-427_44_1-debugsource-0:1-5.el9_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • kpatch-patch-5_14_0-427_44_1-debugsource-0:1-5.el9_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • kpatch-patch-5_14_0-427_55_1-0:1-3.el9_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • kpatch-patch-5_14_0-427_55_1-0:1-3.el9_4.src as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • kpatch-patch-5_14_0-427_55_1-0:1-3.el9_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • kpatch-patch-5_14_0-427_55_1-debuginfo-0:1-3.el9_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • kpatch-patch-5_14_0-427_55_1-debuginfo-0:1-3.el9_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • kpatch-patch-5_14_0-427_55_1-debugsource-0:1-3.el9_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)
  • kpatch-patch-5_14_0-427_55_1-debugsource-0:1-3.el9_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS EUS (v.9.4)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Workaround: In order to trigger the issue, it requires the ability to create user/net namespaces. On non-containerized deployments of Red Hat Enterprise Linux 8, it is recommended to disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. Workaround: To mitigate this issue, prevent module vsock from being loaded. Please see https://access.redhat.com/solutions/41278 for information on how to blacklist a kernel module to prevent it from loading automatically.

🔗 References (5)