Homepage

CVE-2025-21834 The advisory has been revoked - it doesn't affect any version of package kernel-rt-64k-devel  (opens in a new tab)

Threat Intelligence

EPSS
0.18% (8th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-KERNELRT64KDEVEL-12466753
  • published3 Sept 2025
  • disclosed6 Mar 2025
Report a new vulnerability Found a mistake?

Introduced: 6 Mar 2025

CVE-2025-21834  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-rt-64k-devel package and not the kernel-rt-64k-devel package as distributed by RHEL.

In the Linux kernel, the following vulnerability has been resolved:

seccomp: passthrough uretprobe systemcall without filtering

When attaching uretprobes to processes running inside docker, the attached process is segfaulted when encountering the retprobe.

The reason is that now that uretprobe is a system call the default seccomp filters in docker block it as they only allow a specific set of known syscalls. This is true for other userspace applications which use seccomp to control their syscall surface.

Since uretprobe is a "kernel implementation detail" system call which is not used by userspace application code directly, it is impractical and there's very little point in forcing all userspace applications to explicitly allow it in order to avoid crashing tracked processes.

Pass this systemcall through seccomp without depending on configuration.

Note: uretprobe is currently only x86_64 and isn't expected to ever be supported in i386.

[kees: minimized changes for easier backporting, tweaked commit log]