Is CVE-2009-3238 being actively exploited?

CVE-2009-3238 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2009-3238?

CVE-2009-3238 has a CVSS 3.1 base score of 5.5 (MEDIUM).

CVE-2009-3238

MEDIUM · CVSS 5.5EPSS 1.6%EU EUVD

The get_random_int function in drivers/char/random.c in the Linux kernel before 2.6.30 produces insufficiently random numbers, which allows attackers to predict the return value, and possibly defeat protection mechanisms based on randomization, via vectors that leverage the function's tendency to "return the same value over and over again for long stretches of time."

Key facts

CVSS score: 5.5 (v3.1)
Severity: MEDIUM
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE): CWE-338
EPSS score: 1.6% (76th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2009-3221)
Published: September 18, 2009
NVD last modified: June 16, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2009-3221 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.

View on the EU Vulnerability Database

Affected products

canonical / ubuntu linux
canonical / ubuntu linux
canonical / ubuntu linux
canonical / ubuntu linux
linux / linux kernel
opensuse / opensuse
suse / linux enterprise desktop
suse / linux enterprise server

References

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8a0a9bd4db63bc45e3017bedeafbd88d0eb84d02(Broken Link)
http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00005.html(Mailing List)
http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html(Mailing List)
http://patchwork.kernel.org/patch/21766/(Broken Link, Patch)
http://secunia.com/advisories/37105(Broken Link)
http://secunia.com/advisories/37351(Broken Link)
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.30(Broken Link, Exploit, Vendor Advisory)
http://www.redhat.com/support/errata/RHSA-2009-1438.html(Broken Link)
http://www.ubuntu.com/usn/USN-852-1(Third Party Advisory)
https://bugzilla.redhat.com/show_bug.cgi?id=499785(Issue Tracking, Permissions Required)
https://bugzilla.redhat.com/show_bug.cgi?id=519692(Issue Tracking, Permissions Required)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11168(Broken Link)
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03836en_us(Third Party Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain