CVE-2026-64311

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> crypto: loongson - Remove broken and unused loongson-rng<br /> <br /> The loongson-rng rng_alg has several vulnerabilities, including not<br /> providing forward security, and a use-after-free bug due to the use of<br /> wait_for_completion_interruptible().<br /> <br /> Meanwhile, the rng_alg framework doesn&amp;#39;t really have any purpose in the<br /> first place other than to access the software algorithms crypto/drbg.c<br /> and crypto/jitterentropy.c. Hardware-specific rng_algs have no<br /> in-kernel user, and unlike hwrng there&amp;#39;s no feed into the actual Linux<br /> RNG. As such, there&amp;#39;s really no point to this code. There are of<br /> course other rng_alg drivers that are similarly unused, but they&amp;#39;re<br /> similarly in the process of being phased out, e.g.<br /> https://lore.kernel.org/r/20260529193648.18172-1-ebiggers@kernel.org and<br /> https://lore.kernel.org/r/20260529220430.34135-1-ebiggers@kernel.org<br /> <br /> Given that, there&amp;#39;s no point in fixing forward these vulnerabilities,<br /> and it makes much more sense to simply roll back the addition of this<br /> driver. If this platform provides TRNG (not PRNG) functionality, it<br /> could make sense to add a hwrng driver, but it would be quite different.