PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›Document archive›CVE-2026-64306

CVE-2026-64306

kernel: crypto: drbg - Fix returning success on failure in CTR_DRBG

Loading…

Severity

Moderate

Red Hat Product Security

7

CVSS 3.1

Review impact separately from score.

Published · July 25, 2026

Updated · September 4, 2026

Description

A flaw was found in the Linux kernel's Cryptographic API, specifically within the Counter Mode Deterministic Random Bit Generator (CTR_DRBG). The drbg_ctr_generate() function can incorrectly indicate a successful operation even when it has failed. This issue results in the output buffer remaining uninitialized, potentially leading to information disclosure or unpredictable system behavior when this uninitialized data is subsequently used.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 7
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE not specified