Use of insufficiently random values in Linux kernel - CVE-2026-74438

Vulnerability identifier: #VU142666

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-74438

CWE-ID: CWE-330

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to obtain insufficiently random data.

The vulnerability exists due to improper implementation in sun4i_ss_prng_generate() in the sun4i_ss_prng rng implementation when generating random bytes through the AF_ALG "rng" algorithm interface. A local user can request random output to obtain insufficiently random data.

The function rounds the destination length down and does not wait for the hardware to be ready before reading bytes.

Linux kernel
Ubuntu
linux-nvidia (Ubuntu package)
linux-nvidia-tegra (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)
linux-azure (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux-nvidia (Ubuntu package) - addressed in versions 5.15.0-1112.113, 5.15.0.1112.112
linux-nvidia-tegra (Ubuntu package) - update to 6.8.0-1036.39+1
linux-gcp-7.0 (Ubuntu package) - addressed in versions 7.0.0-38.38~24.04.4, 7.0.0-1013.13~24.04.1, 7.0.0-1014.14~24.04.1
linux (Ubuntu package) - addressed in versions 7.0.0-38.38, 7.0.0-38.38.1, 7.0.0-1008.9, 7.0.0-1013.13~24.04.1, 7.0.0-1014.14, 7.0.0-1015.15
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1015.15
linux-azure-7.0 (Ubuntu package) - addressed in versions 7.0.0-1016.16~24.04.1, 7.0.0-1017.17~24.04.1
linux-azure (Ubuntu package) - addressed in versions 7.0.0-1016.16, 7.0.0-1017.17

• https://git.kernel.org/stable/c/2eafecaba1b46bb9774eaf3556619fd5b6a17c1c
• https://git.kernel.org/stable/c/306ded31bfa00a69d25823a60d7c797170bfb4f8
• https://git.kernel.org/stable/c/9c8086d9511189c34dfa3f9e3a03f2bee12f56a5
• https://git.kernel.org/stable/c/b2c41fa9dd8fc740c489e060b199165771f268d1
• https://git.kernel.org/stable/c/c401492e01c7bfd38cf14c94d85c7efafe7d1a25
• https://git.kernel.org/stable/c/e4b7b9819811c4c51064c3d3d3c02f0be7491707
• https://git.kernel.org/stable/c/ee2458f8188732aa53a5d42f56e87bfad288b44e

• Use of insufficiently random values in Linux kernel allwinner sun4i-ss driver
• Ubuntu update for linux-gcp-7.0
• Ubuntu update for linux-nvidia
• Ubuntu update for linux-azure-7.0
• Ubuntu update for linux-nvidia-tegra
• Ubuntu update for linux
• Ubuntu update for linux-azure
• Ubuntu update for linux-oem-7.0