CVE-2026-80834: crypto: sun8i-ce - Remove crypto_rng interface
In the Linux kernel, the following vulnerability has been resolved:
crypto: sun8i-ce - Remove cryptorng interface
Since the cryptorng interface for hardware PRNGs is unused and is redundant with hwrng and the actual Linux RNG, it's being phased out. Most drivers for it were already removed. Go ahead and remove the sun8i-ce support which is one of the only remaining ones.
Note that the sun8i-ce support for hwrng remains in place. That is the interface that actually matters.
As usual for cryptorng, this driver was also buggy: its ->generate() function had a use-after-free vulnerability due to using waitforcompletioninterruptibletimeout() without handling shutting down the DMA operation if a signal is sent. There's no point in fixing this separately only to remove the code anyway, so this commit is marked with Fixes and Cc stable.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
crypto: sun8i-cefrom your environment.Remove the crypto_rng interface for hardware PRNGs from the sun8i-ce driver (crypto: sun8i-ce - Remove crypto_rng interface), since the crypto_rng interface is unused/redundant with hwrng and the actual Linux RNG and is being phased out.
Event History
Frequently Asked Questions
What condition triggers the use-after-free?
The issue occurs when the driver's generate operation is interrupted by a signal while it is waiting for DMA completion. The interrupted path does not shut down the DMA operation before freeing the relevant resources.
Does removing this interface eliminate sun8i-ce hardware random-number support?
No. The sun8i-ce hwrng support remains in place. The removed crypto_rng interface was redundant with hwrng and the Linux RNG.