CVE-2026-74438

A flaw was found in the Linux kernel's sun4i-ss cryptographic random number generator (RNG). This component contains multiple vulnerabilities, including a buffer overflow in the sun4i_ss_prng_seed() function that could lead to a denial of service. Furthermore, the sun4i_ss_prng_generate() function may not generate a full complement of cryptographic random bytes, potentially weakening security where this specific RNG is theoretically used. Although this code is not known to be actively utilized, these underlying issues pose a security risk.

Moderate impact has been assigned because exploitation requires local access to interact with the crypto subsystem and is restricted to specialized Allwinner hardware platforms. Red Hat Enterprise Linux releases do not build or ship the sun4i-ss cryptographic driver in supported kernels, leaving Red Hat environments unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.