Vulnerability · Published Feb 18, 2026 · Assigned by fedora
CVE-2025-0577Glibc: vdso getrandom acceleration may return predictable randomness
Medium 4.8
In plain English
A medium-severity security flaw in glibc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)0.2%top 84.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An insufficient entropy vulnerability was found in glibc. The getrandom and arc4random family of functions may return predictable randomness if these functions are called again after the fork, which happens concurrently with a call to any of these functions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| glibc | 2.39-28.fc40 – through 2.39-33.fc402.40-12.fc41 – through 2.40-17.fc41 | |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
Weakness: CWE-331 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
References
- https://access.redhat.com/security/cve/CVE-2025-0577 vdb-entry, x_refsource_REDHAT
- RHBZ#2338871 issue-tracking, x_refsource_REDHAT