The Linux kernel driver for the Sun8i silicon secure subsystem (sun8i-ss) incorporated a crypto_rng interface that suffered from two critical faults. The first fault was a use‐after‐free bug caused by calling wait_for_completion_interruptible_timeout() without properly shutting down DMA operations when a signal was received, which could corrupt kernel memory and potentially allow privilege escalation. The second fault was a buffer overread in a memcpy that copied seed data beyond the bounds of the destination buffer, which could leak sensitive data or similarly corrupt memory. Although no exploit has been reported in the public domain, these bugs are kernel‑level and could be leveraged by a malicious user with sufficient privileges.

All releases of the Linux kernel that included the sun8i-ss crypto_rng driver—typically embedded firmware for Linux SoCs that ship with Sun8i silicon. The driver is part of the mainline kernel source and was active in various stable series at the time the bugs were fixed. The specific product families are those using the Sun8i secure subsystem hardware RNG facilities, but the vulnerability was confined to this driver and not to the underlying hardware RNG itself.

While the EPSS score is not provided and the vulnerability is not listed in CISA KEV, the kernel bugs are severe and could lead to memory corruption or data leaks if triggered. The risk is considered mitigated once the driver code is removed, as the patch eliminates the source of both the use‑after‑free and buffer overread defects. In the absence of a public exploit, the probability of exploitation remains low until an attacker discovers a new code path; however, the potential impact justifies prompt remediation.