Cloudanix VulnDB

CVE-2026-80834

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in random-number support for certain encryption hardware on Linux could let an attacker crash the system or potentially run code with higher privileges.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free vulnerability in the sun8i-ce driver's crypto_rng ->generate() function caused by failing to properly terminate DMA operations when wait_for_completion_interruptible_timeout() is interrupted by a signal.

Why it matters to the business

On systems using the sun8i-ce hardware crypto module, attackers could potentially cause kernel instability or memory corruption leading to crashes or code execution, though the affected interface is deprecated and rarely used; low exploitation likelihood means limited operational disruption for most environments.

How an attack unfolds

An attacker with local access triggers the crypto_rng generate operation on affected Allwinner hardware and sends an interrupting signal during the wait period, causing the DMA resources to be freed while still referenced.

How to fix it

Upgrade to a Linux kernel version containing the commit that removes sun8i-ce crypto_rng support; the hwrng interface remains unaffected and should be used instead.

How to confirm the fix worked

Confirm removal of the vulnerable generate function in kernel source or verify the presence of the resolving commit in the running kernel tree.

Typical attack path

  1. Locate Linux system exposing sun8i-ce crypto_rng interface
  2. Invoke generate function via userspace crypto API
  3. Deliver signal to interrupt wait_for_completion to trigger UAF

How to detect it

Search kernel logs and crash dumps for use-after-free reports involving sun8i-ce or crypto_rng generate paths; monitor for unexpected signals during hardware RNG calls.

What your security team should do

  • Prioritize kernel updates on any systems with sun8i-ce hardware
  • Audit for legacy crypto_rng usage and migrate to hwrng
  • Review kernel configuration to ensure unused PRNG interfaces are disabled

The record

In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ce - Remove crypto_rng interface Since the crypto_rng interface for hardware PRNGs is unused and is redundant with hwrng and the actual Linux RNG, it's being phased out. Most drivers for it were already removed. Go ahead and remove the sun8i-ce support which is one of the only remaining ones. Note that the sun8i-ce support for hwrng remains in place. That is the interface that actually matters. As usual for crypto_rng, this driver was also buggy: its ->generate() function had a use-after-free vulnerability due to using wait_for_completion_interruptible_timeout() without handling shutting down the DMA operation if a signal is sent. There's no point in fixing this separately only to remove the code anyway, so this commit is marked with Fixes and Cc stable.

Affected packages

Ecosystem Package Introduced Fixed