CVE-2025-5372 is a vulnerability in libssh related to incorrect return code handling in the ssh_kdf() function, which is part of the key derivation process in the SSH protocol implementation. This flaw could potentially affect the security of SSH client and server applications using this library. Red Hat has released updated libssh packages for Red Hat Enterprise Linux 8.8 to fix this issue, as detailed in advisory RHSA-2026:20610. The vulnerability is rated as moderate severity by Red Hat Product Security. No CVSS score is provided in the advisory or CVE data.

The vulnerability impacts libssh versions included in Red Hat Enterprise Linux 8.8 and related update services. Incorrect return code handling in ssh_kdf() may lead to unexpected behavior in SSH key derivation, potentially weakening the security guarantees of SSH sessions. However, no known exploits have been reported in the wild, and the severity is assessed as moderate by the vendor.

Red Hat has released updated libssh packages that address CVE-2025-5372. Users of affected Red Hat Enterprise Linux 8.8 variants should apply these official updates as described in Red Hat advisory RHSA-2026:20610 and the referenced update article (https://access.redhat.com/articles/11258). Applying these updates will remediate the vulnerability. There is no indication that additional mitigation steps are required beyond applying the vendor-provided patches.