Skip to content
OpenAdvisories
Medium ALSA-2025:18298 3 CVEs

Moderate: kernel-rt security update

Published Oct 20, 2025 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

* kernel: ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CVE-2025-39757)
* kernel: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CVE-2025-39751)
* kernel: crypto: seqiv - Handle EBUSY correctly (CVE-2023-53373)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 10

ReleasePackageFixed in
AlmaLinux · 8 kernel-rt 4.18.0-553.80.1.rt7.421.el8_10
AlmaLinux · 8 kernel-rt-core 4.18.0-553.80.1.rt7.421.el8_10
AlmaLinux · 8 kernel-rt-debug 4.18.0-553.80.1.rt7.421.el8_10
AlmaLinux · 8 kernel-rt-debug-core 4.18.0-553.80.1.rt7.421.el8_10
AlmaLinux · 8 kernel-rt-debug-devel 4.18.0-553.80.1.rt7.421.el8_10
AlmaLinux · 8 kernel-rt-debug-modules 4.18.0-553.80.1.rt7.421.el8_10
AlmaLinux · 8 kernel-rt-debug-modules-extra 4.18.0-553.80.1.rt7.421.el8_10
AlmaLinux · 8 kernel-rt-devel 4.18.0-553.80.1.rt7.421.el8_10
AlmaLinux · 8 kernel-rt-modules 4.18.0-553.80.1.rt7.421.el8_10
AlmaLinux · 8 kernel-rt-modules-extra 4.18.0-553.80.1.rt7.421.el8_10

Vulnerabilities 3

  • High 7.8
    CVE-2023-53373

    crypto: seqiv - Handle EBUSY correctly

    In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Handle EBUSY correctly As it is seqiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request. Howev…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-39751 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

    linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  • Unscored —
    CVE-2025-39757

    ALSA: usb-audio: Validate UAC3 cluster segment descriptors

    In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 cluster segment descriptors UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2023-53373
  • report
    https://access.redhat.com/security/cve/CVE-2025-39751
  • report
    https://access.redhat.com/security/cve/CVE-2025-39757
  • report
    https://bugzilla.redhat.com/2394615
  • report
    https://bugzilla.redhat.com/2394624
  • report
    https://bugzilla.redhat.com/2396379
  • advisory
    https://errata.almalinux.org/8/ALSA-2025-18298.html