In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ce - Remove crypto_rng interface Since the crypto_rng interface for hardware PRNGs is unused and is redundant with hwrng and the actual Linux RNG, it's being phased out. Most drivers for it were already removed. Go ahead and remove the sun8i-ce support which is one of the only remaining ones. Note that the sun8i-ce support for hwrng remains in place. That is the interface that actually matters. As usual for crypto_rng, this driver was also buggy: its ->generate() function had a use-after-free vulnerability due to using wait_for_completion_interruptible_timeout() without handling shutting down the DMA operation if a signal is sent. There's no point in fixing this separately only to remove the code anyway, so this commit is marked with Fixes and Cc stable.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 2
- StatusReceived → PublishedNVD modified 2026-10-19 08:44
- First seenunscoredNVD modified 2026-10-19 09:17
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 8
- https://git.kernel.org/stable/c/011556f71d094da61379ae3672692cae2795304e
- https://git.kernel.org/stable/c/1017f987c5f0841f00408a78f947990c9d84b346
- https://git.kernel.org/stable/c/19588f78db582ba4c47b4001bb27f39bb19dc432
- https://git.kernel.org/stable/c/2c8fa2299789282db1aac566a60c2012a5ba8ea8
- https://git.kernel.org/stable/c/7bb9e6060710eb7b59491d9826169190297adace
- https://git.kernel.org/stable/c/8e4f9110aba3127024646ef7a8999dcfcc03f516
- https://git.kernel.org/stable/c/b69af40720cabd13da763575022a3d4430b02dfc
- https://git.kernel.org/stable/c/ce641e75e0fc912acd4bf661367617561bc7c63f