https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 18:54:26 +0000 https://vulnerability.circl.lu/vuln/cve-2026-74438 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>crypto: sun4i-ss - Remove insecure and unused rng_alg</p> <p>Remove sun4i_ss_rng, as it is insecure and unused:</p> <p>- It has multiple vulnerabilities. sun4i_ss_prng_seed() is missing locking and has a buffer overflow. sun4i_ss_prng_generate() fails to fill the entire buffer with cryptographic random bytes, because it rounds the destination length down and also doesn&#39;t actually wait for the hardware to be ready before pulling bytes from it.</p> <p>- No user of this code is known. It&#39;s usable only theoretically via the &#34;rng&#34; algorithm type of AF_ALG. But userspace actually just uses the actual Linux RNG (/dev/random etc) instead. And rng_algs don&#39;t contribute entropy to the actual Linux RNG either. (This may have been confused with hwrng, which does contribute entropy.)</p> <p>The sun4i_ss_prng_seed() buffer overflow was reported by Tianchu Chen and discovered by Atuin - Automated Vulnerability Discovery Engine</p> <p>There&#39;s no point in fixing all these vulnerabilities individually when this is unused code, so let&#39;s just remove it.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>crypto: sun4i-ss - Remove insecure and unused rng_alg</p> <p>Remove sun4i_ss_rng, as it is insecure and unused:</p> <p>- It has multiple vulnerabilities. sun4i_ss_prng_seed() is missing locking and has a buffer overflow. sun4i_ss_prng_generate() fails to fill the entire buffer with cryptographic random bytes, because it rounds the destination length down and also doesn&#39;t actually wait for the hardware to be ready before pulling bytes from it.</p> <p>- No user of this code is known. It&#39;s usable only theoretically via the &#34;rng&#34; algorithm type of AF_ALG. But userspace actually just uses the actual Linux RNG (/dev/random etc) instead. And rng_algs don&#39;t contribute entropy to the actual Linux RNG either. (This may have been confused with hwrng, which does contribute entropy.)</p> <p>The sun4i_ss_prng_seed() buffer overflow was reported by Tianchu Chen and discovered by Atuin - Automated Vulnerability Discovery Engine</p> <p>There&#39;s no point in fixing all these vulnerabilities individually when this is unused code, so let&#39;s just remove it.</p> https://vulnerability.circl.lu/vuln/cve-2026-74438