The loongson‑rng driver implements a software random number generator in the Linux kernel but suffers from multiple weaknesses, including a lack of forward security and a use‑after‑free bug triggered by wait_for_completion_interruptible(). The bug can corrupt kernel memory if the driver’s RNG functions are invoked, potentially leading to data corruption, denial of service, or privilege escalation within the kernel context. The driver also does not feed entropy into the core kernel RNG subsystem, rendering it effectively useless for system operation and exposing the system to the memory corruption risk.

This vulnerability is present only in Linux kernel releases that still include the loongson‑rng algorithm. Any kernel built for Loongson processors which has not yet rolled back the driver contains the flaw. No specific kernel version numbers are named, but any kernel snapshot that has the implementation before its removal is affected.

The EPSS score indicates an exploitation probability of less than 1%, and the vulnerability has not been listed in the CISA KEV catalog. The CVSS score of 7.8 denotes high severity. Based on the description, it is inferred that the attack vector is local, requiring the ability to trigger RNG output via the loongson‑rng interface, which would typically be limited to users with local or root access. Because the driver’s API is tied to kernel‑level RNG calls and is not exposed to network interfaces, there is no documented remote exploitation path. An attacker exploiting the use‑after‑free could cause kernel memory corruption, potentially leading to denial of service or arbitrary code execution within the kernel if memory is overwritten with malicious content. The exposure window will shorten as the driver is removed in newer kernels.