Linux Kernel Vulnerability in Crypto Random Number Generator

CVE-2025-40109

What is CVE-2025-40109?

A vulnerability exists in the Linux kernel's crypto random number generator, where the set_ent function is not guaranteed to be consistently applied. This issue arises from the design where only the deterministic random bit generator (drbg) uses the set_ent function. As a result, failing to ensure that set_ent is present may lead to inadequate randomness in cryptographic operations, potentially compromising security measures that rely on robust random number generation. This vulnerability underscores the importance of stringent configuration in cryptographic implementations to maintain system integrity and data protection.

References