Glibc: vdso getrandom acceleration may return predictable randomness

Description

An insufficient entropy vulnerability was found in glibc. The getrandom and arc4random family of functions may return predictable randomness if these functions are called again after the fork, which happens concurrently with a call to any of these functions.

Scores

EPSS (exploitation in 30 days)

0.25% · top 84% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.8.

Weakness

• CWE-331: Insufficient Entropy (opens in a new tab)All about CWE-331 and its CVEs

Affected products

• glibc

  • affected 2.39-28.fc40 – ≤ 2.39-33.fc40
  • affected 2.40-12.fc41 – ≤ 2.40-17.fc41

• Red Hat · Red Hat Enterprise Linux 10

  All versions: unaffected

• Red Hat · Red Hat Enterprise Linux 6

  All versions: unaffected

• Red Hat · Red Hat Enterprise Linux 7

  All versions: unaffected

• Red Hat · Red Hat Enterprise Linux 8

  All versions: unaffected

• Red Hat · Red Hat Enterprise Linux 9

  All versions: unaffected

What to do

Workaround: Red Hat Product Security does not have any mitigation recommendations at this time.

References (2)

• https://access.redhat.com/security/cve/CVE-2025-0577 (opens in a new tab)vdb-entryx_refsource_REDHAT
• RHBZ#2338871 (opens in a new tab)issue-trackingx_refsource_REDHAT

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-0577](https://trackcve.app/badge/CVE-2025-0577.svg)](https://trackcve.app/cve/CVE-2025-0577)

Record last updated 25 Feb 2026, 16:54 UTC.