{"apiVersion":"1.0","identifier":"CVE-2026-74438","description":"In the Linux kernel, the following vulnerability has been resolved: crypto: sun4i-ss - Remove insecure and unused rng_alg Remove sun4i_ss_rng, as it is insecure and unused: - It has multiple vulnerabilities. sun4i_ss_prng_seed() is missing locking and has a buffer overflow. sun4i_ss_prng_generate() fails to fill the entire buffer with cryptographic random bytes, because it rounds the destination length down and also doesn-t actually wait for the hardware to be ready before pulling bytes from it. - No user of this code is known. It-s usable only theoretically via the -rng- algorithm type of AF_ALG. But userspace actually just uses the actual Linux RNG (/dev/random etc) instead. And rng_algs don-t contribute entropy to the actual Linux RNG either. (This may have been confused with hwrng, which does contribute entropy.) The sun4i_ss_prng_seed() buffer overflow was reported by Tianchu Chen and discovered by Atuin - Automated Vulnerability Discovery Engine There-s no point in fixing all these vulnerabilities individually when this is unused code, so let-s just remove it.","publishedAt":"2026-08-15T06:22:45","lastModifiedAt":"2026-08-17T06:19:39","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74438","cvssScore":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00133,"riskScore":0.79,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74438","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74438","en":"https://www.redsauce.net/en/cves/CVE-2026-74438","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74438","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74438","de":"https://www.redsauce.net/de/cves/CVE-2026-74438","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74438","el":"https://www.redsauce.net/el/cves/CVE-2026-74438"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74438"}}