CVE-2026-80833: crypto: sun8i-ss - Remove crypto_rng interface
In the Linux kernel, the following vulnerability has been resolved:
crypto: sun8i-ss - Remove cryptorng interface
Since the cryptorng interface for hardware PRNGs is unused and is redundant with hwrng and the actual Linux RNG, it's being phased out. Most drivers for it were already removed. Go ahead and remove the sun8i-ss support which is one of the only remaining ones.
As usual for cryptorng, this driver was also buggy: its ->generate() function had a use-after-free vulnerability due to using waitforcompletioninterruptibletimeout() without handling shutting down the DMA operation if a signal is sent. Also, it had a buffer overread bug in the line 'memcpy(ctx->seed, d + dlen, ctx->slen);'. There's no point in fixing these bugs separately only to remove the code anyway, so this commit is marked with Fixes and Cc stable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
crypto: sun8i-ssfrom your environment.Remove the crypto_rng interface for sun8i-ss ("crypto: sun8i-ss - Remove crypto_rng interface").
- Remove
Remove
Linux crypto_rng interface for hardware PRNGsfrom your environment.Remove unused crypto_rng interface code for hardware PRNGs since the crypto_rng interface for hardware PRNGs is unused and being phased out/redundant with hwrng and the actual Linux RNG.
Event History
Frequently Asked Questions
Which systems are relevant to this issue?
The affected code is the sun8i-ss driver's hardware random-number support through the crypto_rng interface. The description states that this interface is unused and redundant with the hardware RNG and Linux RNG facilities.
What conditions trigger the use-after-free issue?
The driver's generate function can be affected when wait_for_completion_interruptible_timeout() is interrupted by a signal and the DMA operation is not shut down. The same removed code also contained a buffer overread in its seed-copy operation.
How is this issue addressed upstream?
The vulnerable crypto_rng support was removed from the sun8i-ss driver rather than having the individual bugs fixed. The change is marked for stable backporting.