CVE-2025-8058: 
Rocky Linux vulnerability analysis and mitigation

A double-free vulnerability (CVE-2025-8058) was discovered in the regcomp function of the GNU C Library (glibc) versions 2.4 through 2.41. The vulnerability was disclosed on July 23, 2025, affecting all architectures and ABIs supported by the GNU C library (NVD, Snyk DB).

The vulnerability occurs during bracket expression parsing within the regcomp function when a previous allocation fails. This can be triggered either by a malloc failure or by using an interposed malloc that injects random malloc failures. The vulnerability has been assigned CWE-415 (Double Free) and received a CVSS v3.1 base score of 4.2 (Medium), with attack vector being Local, attack complexity High, and requiring low privileges with user interaction (NVD, Snyk DB).

The double free vulnerability can potentially allow buffer manipulation depending on how the regex is constructed. The impact assessment indicates low impact on confidentiality, integrity, and availability. While data modification is possible, the attacker has limited control over the consequences of modifications (Snyk DB).

As of the disclosure date, there is no fixed version available for affected distributions including Debian 12 and RHEL 8 (Snyk DB).