crypto: sun4i-ss - Remove insecure and unused rng_alg

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-74438
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-15 06:22:45 UTC
Updated2026-08-15 06:22:45 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: crypto: sun4i-ss - Remove insecure and unused rng_alg Remove sun4i_ss_rng, as it is insecure and unused: - It has multiple vulnerabilities. sun4i_ss_prng_seed() is missing locking and has a buffer overflow. sun4i_ss_prng_generate() fails to fill the entire buffer with cryptographic random bytes, because it rounds the destination length down and also doesn't actually wait for the hardware to be ready before pulling bytes from it. - No user of this code is known. It's usable only theoretically via the "rng" algorithm type of AF_ALG. But userspace actually just uses the actual Linux RNG (/dev/random etc) instead. And rng_algs don't contribute entropy to the actual Linux RNG either. (This may have been confused with hwrng, which does contribute entropy.) The sun4i_ss_prng_seed() buffer overflow was reported by Tianchu Chen and discovered by Atuin - Automated Vulnerability Discovery Engine There's no point in fixing all these vulnerabilities individually when this is unused code, so let's just remove it.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected b8ae5c7387ad075ee61e8c8774ce2bca46bc9236 2eafecaba1b46bb9774eaf3556619fd5b6a17c1c git Not specified
CNA Linux Linux affected b8ae5c7387ad075ee61e8c8774ce2bca46bc9236 ee2458f8188732aa53a5d42f56e87bfad288b44e git Not specified
CNA Linux Linux affected b8ae5c7387ad075ee61e8c8774ce2bca46bc9236 306ded31bfa00a69d25823a60d7c797170bfb4f8 git Not specified
CNA Linux Linux affected b8ae5c7387ad075ee61e8c8774ce2bca46bc9236 e4b7b9819811c4c51064c3d3d3c02f0be7491707 git Not specified
CNA Linux Linux affected b8ae5c7387ad075ee61e8c8774ce2bca46bc9236 c401492e01c7bfd38cf14c94d85c7efafe7d1a25 git Not specified
CNA Linux Linux affected b8ae5c7387ad075ee61e8c8774ce2bca46bc9236 9c8086d9511189c34dfa3f9e3a03f2bee12f56a5 git Not specified
CNA Linux Linux affected b8ae5c7387ad075ee61e8c8774ce2bca46bc9236 b2c41fa9dd8fc740c489e060b199165771f268d1 git Not specified
CNA Linux Linux affected 4.14 Not specified
CNA Linux Linux unaffected 4.14 semver Not specified
CNA Linux Linux unaffected 5.15.212 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.178 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.145 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.97 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.40 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.5 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2-rc1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/b2c41fa9dd8fc740c489e060b199165771f268d1 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/2eafecaba1b46bb9774eaf3556619fd5b6a17c1c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/c401492e01c7bfd38cf14c94d85c7efafe7d1a25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/9c8086d9511189c34dfa3f9e3a03f2bee12f56a5 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/ee2458f8188732aa53a5d42f56e87bfad288b44e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e4b7b9819811c4c51064c3d3d3c02f0be7491707 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/306ded31bfa00a69d25823a60d7c797170bfb4f8 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report