CVE-2026-74438

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> crypto: sun4i-ss - Remove insecure and unused rng_alg<br /> <br /> Remove sun4i_ss_rng, as it is insecure and unused:<br /> <br /> - It has multiple vulnerabilities. sun4i_ss_prng_seed() is missing<br /> locking and has a buffer overflow. sun4i_ss_prng_generate() fails to<br /> fill the entire buffer with cryptographic random bytes, because it<br /> rounds the destination length down and also doesn&amp;#39;t actually wait for<br /> the hardware to be ready before pulling bytes from it.<br /> <br /> - No user of this code is known. It&amp;#39;s usable only theoretically via the<br /> "rng" algorithm type of AF_ALG. But userspace actually just uses the<br /> actual Linux RNG (/dev/random etc) instead. And rng_algs don&amp;#39;t<br /> contribute entropy to the actual Linux RNG either. (This may have<br /> been confused with hwrng, which does contribute entropy.)<br /> <br /> The sun4i_ss_prng_seed() buffer overflow was reported by Tianchu Chen<br /> and discovered by Atuin - Automated Vulnerability Discovery Engine<br /> <br /> There&amp;#39;s no point in fixing all these vulnerabilities individually when<br /> this is unused code, so let&amp;#39;s just remove it.