RHSA-2025:8345HighCVSS 7.8

Red Hat Security Advisory: kpatch-patch-4_18_0-553, kpatch-patch-4_18_0-553_16_1, kpatch-patch-4_18_0-553_30_1, and kpatch-patch-4_18_0-553_40_1 security update

Published
June 2, 2025
Last Modified
August 4, 2026

🔗 CVE IDs covered (2)

CVE-2024-53141 →CVE-2025-21756 →

📋 Description

CVE-2024-53141 — kernel: netfilter: ipset: add missing range check in bitmap_ip_uadt CVE-2025-21756 — kernel: vsock: Keep the binding until socket destruction

🎯 Affected products29

  • Red Hat Enterprise Linux BaseOS (v. 8)
  • kpatch-patch-4_18_0-553-0:1-6.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kpatch-patch-4_18_0-553-0:1-6.el8_10.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kpatch-patch-4_18_0-553-0:1-6.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kpatch-patch-4_18_0-553-debuginfo-0:1-6.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kpatch-patch-4_18_0-553-debuginfo-0:1-6.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kpatch-patch-4_18_0-553-debugsource-0:1-6.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kpatch-patch-4_18_0-553-debugsource-0:1-6.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kpatch-patch-4_18_0-553_16_1-0:1-5.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kpatch-patch-4_18_0-553_16_1-0:1-5.el8_10.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kpatch-patch-4_18_0-553_16_1-0:1-5.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kpatch-patch-4_18_0-553_16_1-debuginfo-0:1-5.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kpatch-patch-4_18_0-553_16_1-debuginfo-0:1-5.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kpatch-patch-4_18_0-553_16_1-debugsource-0:1-5.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kpatch-patch-4_18_0-553_16_1-debugsource-0:1-5.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kpatch-patch-4_18_0-553_30_1-0:1-4.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kpatch-patch-4_18_0-553_30_1-0:1-4.el8_10.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kpatch-patch-4_18_0-553_30_1-0:1-4.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kpatch-patch-4_18_0-553_30_1-debuginfo-0:1-4.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kpatch-patch-4_18_0-553_30_1-debuginfo-0:1-4.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kpatch-patch-4_18_0-553_30_1-debugsource-0:1-4.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kpatch-patch-4_18_0-553_30_1-debugsource-0:1-4.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kpatch-patch-4_18_0-553_40_1-0:1-2.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kpatch-patch-4_18_0-553_40_1-0:1-2.el8_10.src as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kpatch-patch-4_18_0-553_40_1-0:1-2.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kpatch-patch-4_18_0-553_40_1-debuginfo-0:1-2.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kpatch-patch-4_18_0-553_40_1-debuginfo-0:1-2.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kpatch-patch-4_18_0-553_40_1-debugsource-0:1-2.el8_10.ppc64le as a component of Red Hat Enterprise Linux BaseOS (v. 8)
  • kpatch-patch-4_18_0-553_40_1-debugsource-0:1-2.el8_10.x86_64 as a component of Red Hat Enterprise Linux BaseOS (v. 8)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Workaround: In order to trigger the issue, it requires the ability to create user/net namespaces. On non-containerized deployments of Red Hat Enterprise Linux 8, it is recommended to disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. Workaround: To mitigate this issue, prevent module vsock from being loaded. Please see https://access.redhat.com/solutions/41278 for information on how to blacklist a kernel module to prevent it from loading automatically.

🔗 References (5)