Executive brief
A vulnerability in the Linux kernel's cryptographic random number generator could allow the system to incorrectly report that it has successfully generated random data when it has actually failed. This results in the use of uninitialized memory instead of secure random numbers, which can weaken the security of encrypted communications or digital signatures. The issue has been resolved in various stable versions of the Linux kernel.
Technical details
A logic error in the Linux kernel's crypto/drbg.c component within the drbg_ctr_generate() function causes it to return 0 (success) even when an internal call to drbg_ctr_update() fails. This occurs when additional data is provided and the update process encounters an error. Because the function reports success, the caller may proceed to use the output buffer, which remains uninitialized. This can lead to the leakage of kernel memory or the use of predictable data in cryptographic operations. The fix ensures that the actual error code from drbg_ctr_update() is propagated to the caller. Patches have been backported to multiple stable kernel branches.
Affected products
- Linux Linux 3.12.44 to 3.13; 4.1; 5.10.261; 5.15.212
Timeline
- 2026-07-25: disclosed
- 2026-07-25: advisory
References
- https://git.kernel.org/stable/c/074db6db03a0aaa78f05ca9d4838053713796665
- https://git.kernel.org/stable/c/23b8b188cb32e5531d0f8d3af9506f8959cb369e
- https://git.kernel.org/stable/c/39a31ad9e2a5ed7e9c9c6f711dca96c8c8f5f26b
- https://git.kernel.org/stable/c/75597e8774f319152744d24e0683d9393540a951
- https://git.kernel.org/stable/c/7b03312491f9fe6ba4d60c4023e7e61d2d1fed96
- https://git.kernel.org/stable/c/a9e886f73dd717027028bb7e3bbca93601ecdfc7
- https://git.kernel.org/stable/c/bbbac12083eff489b35d848332f0dff311131344