CVE-2026-80833

What it actually does

Use-after-free in the sun8i-ss driver's crypto_rng ->generate() function from missing DMA shutdown handling on signal interruption via wait_for_completion_interruptible_timeout(), plus a buffer overread in memcpy of seed data.

Why it matters to the business

Low-likelihood local denial of service or privilege escalation on systems with the affected Allwinner hardware RNG driver in older kernels; minimal operational risk given removal of the interface and negligible exploit probability.

How an attack unfolds

A local attacker triggers RNG generation through the crypto_rng interface, sends an interrupting signal during DMA wait, and leverages the resulting use-after-free for memory corruption; no named threat actors or campaigns are associated.

How to fix it

Upgrade to a Linux kernel containing the commit that removes sun8i-ss crypto_rng support; no specific fixed versions are published for this resolution.

How to confirm the fix worked

Inspect kernel source or running configuration to confirm absence of sun8i-ss crypto_rng registration and related generate() implementation.

Typical attack path

1. Obtain local user access on a system exposing the sun8i-ss crypto_rng interface
2. Invoke hardware RNG generation via the crypto API
3. Deliver a signal to interrupt the wait_for_completion call
4. Exploit the dangling reference after DMA shutdown is skipped for memory corruption or code execution

How to detect it

Review kernel logs for sun8i-ss related crashes or warnings around crypto_rng usage and signal handling; examine audit logs for unexpected calls to the hardware RNG interface.

What your security team should do

• Prioritize kernel updates on any systems still running pre-removal sun8i-ss drivers
• Audit for custom or out-of-tree uses of the deprecated crypto_rng interface
• Monitor EPSS and exploit maturity indicators for any change in risk posture