SB2026081521 - Use of insufficiently random values in Linux kernel allwinner sun4i-ss driver

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081521

SB2026081521 - Use of insufficiently random values in Linux kernel allwinner sun4i-ss driver

Published: August 15, 2026

Security Bulletin ID SB2026081521
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Use of insufficiently random values (CVE-ID: CVE-2026-74438)

CWE-ID: CWE-330 - Use of Insufficiently Random Values

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to obtain insufficiently random data.

The vulnerability exists due to improper implementation in sun4i_ss_prng_generate() in the sun4i_ss_prng rng implementation when generating random bytes through the AF_ALG "rng" algorithm interface. A local user can request random output to obtain insufficiently random data.

The function rounds the destination length down and does not wait for the hardware to be ready before reading bytes.


Remediation

Install update from vendor's website.

References