CVE-2025-8058: 
Rocky Linux vulnerability analysis and mitigation

CVE-2025-8058 is a double free vulnerability in the regcomp function of the GNU C Library (glibc), tracked under advisory GLIBC-SA-2025-0005. It affects glibc versions 2.4 through 2.41 across all supported architectures and ABIs. The flaw was publicly disclosed on July 23, 2025, with the fix committed in glibc 2.42. It carries a CVSS v4.0 base score of 5.9 (Medium) (Red Hat Advisory, oss-security).

The root cause is a double free (CWE-415) in glibc's regcomp function, which compiles regular expressions. When a memory allocation fails during regex compilation — either through a genuine malloc failure or via an interposed malloc that injects random failures — the function incorrectly frees a memory region that has already been freed. Depending on how the regular expression is constructed, this double free can enable heap buffer manipulation, potentially leading to arbitrary code execution. The vulnerable code was introduced as far back as glibc commit 963d8d782fc98fb6dc3a66f0068795f9920c269d (version 2.3.3) and was fixed in commit 7ea06e994093fa0bcca0d0ee2c1db271d8d7885d (version 2.42) (oss-security, Red Hat Bugzilla).

Successful exploitation allows a local user to manipulate heap memory, potentially executing arbitrary code with the privileges of the process invoking the affected glibc regex function. The vulnerability affects confidentiality (low), integrity (low), and availability (high) at the vulnerable component level, with similar subsidiary impacts on other system components. Given glibc's ubiquity as a foundational library on Linux systems, any application that calls regcomp with attacker-influenced input or under memory pressure conditions could be affected (Red Hat Advisory, oss-security).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.014% (0.000140), reflecting a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access, low privileges, passive user interaction, and specific attack preconditions (memory allocation failure), making opportunistic exploitation difficult (Red Hat Advisory).

The fix is available in glibc version 2.42, which includes commit 7ea06e994093fa0bcca0d0ee2c1db271d8d7885d. Red Hat has released security errata for affected products: RHSA-2025:12748 (RHEL 9), RHSA-2025:12980 (RHEL 8), and RHSA-2025:13240 (RHEL 10). Additional errata have been issued for RHEL variants and downstream distributions including Oracle Linux, AlmaLinux, Debian (DLA-4621-1), and Ubuntu (USN-8005-1). Administrators should update glibc packages to the patched versions provided by their distribution as soon as possible, prioritizing systems where untrusted applications or users can trigger regex compilation (Red Hat Bugzilla, oss-security).

The vulnerability was disclosed via the oss-security mailing list by Adhemerval Zanella Netto of Linaro on July 23, 2025, alongside the official glibc security advisory GLIBC-SA-2025-0005. Multiple Linux distributions including Red Hat, Oracle, Debian, Ubuntu, SUSE, AlmaLinux, and Amazon Linux 2 issued patches within days to weeks of disclosure. Community discussion on Mastodon and Fedora-related forums noted the broad impact given glibc's role as a foundational library, though the moderate CVSS score and local-only attack vector tempered urgency (oss-security, Red Hat Advisory).