RHSA-2025:8348HighCVSS 7.8

Red Hat Security Advisory: kpatch-patch-4_18_0-305_120_1, kpatch-patch-4_18_0-305_138_1, kpatch-patch-4_18_0-305_145_1, and kpatch-patch-4_18_0-305_150_1 security update

Published
June 2, 2025
Last Modified
August 4, 2026

🔗 CVE IDs covered (2)

CVE-2024-53141 →CVE-2025-21756 →

📋 Description

CVE-2024-53141 — kernel: netfilter: ipset: add missing range check in bitmap_ip_uadt CVE-2025-21756 — kernel: vsock: Keep the binding until socket destruction

🎯 Affected products29

  • Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • kpatch-patch-4_18_0-305_120_1-0:1-10.el8_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • kpatch-patch-4_18_0-305_120_1-0:1-10.el8_4.src as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • kpatch-patch-4_18_0-305_120_1-0:1-10.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • kpatch-patch-4_18_0-305_120_1-debuginfo-0:1-10.el8_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • kpatch-patch-4_18_0-305_120_1-debuginfo-0:1-10.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • kpatch-patch-4_18_0-305_120_1-debugsource-0:1-10.el8_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • kpatch-patch-4_18_0-305_120_1-debugsource-0:1-10.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • kpatch-patch-4_18_0-305_138_1-0:1-6.el8_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • kpatch-patch-4_18_0-305_138_1-0:1-6.el8_4.src as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • kpatch-patch-4_18_0-305_138_1-0:1-6.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • kpatch-patch-4_18_0-305_138_1-debuginfo-0:1-6.el8_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • kpatch-patch-4_18_0-305_138_1-debuginfo-0:1-6.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • kpatch-patch-4_18_0-305_138_1-debugsource-0:1-6.el8_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • kpatch-patch-4_18_0-305_138_1-debugsource-0:1-6.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • kpatch-patch-4_18_0-305_145_1-0:1-4.el8_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • kpatch-patch-4_18_0-305_145_1-0:1-4.el8_4.src as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • kpatch-patch-4_18_0-305_145_1-0:1-4.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • kpatch-patch-4_18_0-305_145_1-debuginfo-0:1-4.el8_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • kpatch-patch-4_18_0-305_145_1-debuginfo-0:1-4.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • kpatch-patch-4_18_0-305_145_1-debugsource-0:1-4.el8_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • kpatch-patch-4_18_0-305_145_1-debugsource-0:1-4.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • kpatch-patch-4_18_0-305_150_1-0:1-2.el8_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • kpatch-patch-4_18_0-305_150_1-0:1-2.el8_4.src as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • kpatch-patch-4_18_0-305_150_1-0:1-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • kpatch-patch-4_18_0-305_150_1-debuginfo-0:1-2.el8_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • kpatch-patch-4_18_0-305_150_1-debuginfo-0:1-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • kpatch-patch-4_18_0-305_150_1-debugsource-0:1-2.el8_4.ppc64le as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)
  • kpatch-patch-4_18_0-305_150_1-debugsource-0:1-2.el8_4.x86_64 as a component of Red Hat Enterprise Linux BaseOS E4S (v.8.4)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 The system must be rebooted for this update to take effect. Workaround: In order to trigger the issue, it requires the ability to create user/net namespaces. On non-containerized deployments of Red Hat Enterprise Linux 8, it is recommended to disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. Workaround: To mitigate this issue, prevent module vsock from being loaded. Please see https://access.redhat.com/solutions/41278 for information on how to blacklist a kernel module to prevent it from loading automatically.

🔗 References (5)