CVE-2026-64306 PUBLISHED

crypto: drbg - Fix returning success on failure in CTR_DRBG

Assigner: Linux
Reserved: 19.07.2026 Published: 25.07.2026 Updated: 25.07.2026

In the Linux kernel, the following vulnerability has been resolved:

crypto: drbg - Fix returning success on failure in CTR_DRBG

drbg_ctr_generate() sometimes returns success when it fails, leaving the output buffer uninitialized. Fix it.

Vendor	Linux
Product	Linux
Versions	Default: unaffected affected from cde001e4c3c3625c60b68a83eb1f1c2572dee07a to 074db6db03a0aaa78f05ca9d4838053713796665 (excl.) affected from cde001e4c3c3625c60b68a83eb1f1c2572dee07a to 7b03312491f9fe6ba4d60c4023e7e61d2d1fed96 (excl.) affected from cde001e4c3c3625c60b68a83eb1f1c2572dee07a to 75597e8774f319152744d24e0683d9393540a951 (excl.) affected from cde001e4c3c3625c60b68a83eb1f1c2572dee07a to cc42fb40171c249bb859071d81b4eb007398a0bc (excl.) affected from cde001e4c3c3625c60b68a83eb1f1c2572dee07a to bbbac12083eff489b35d848332f0dff311131344 (excl.) affected from cde001e4c3c3625c60b68a83eb1f1c2572dee07a to 23b8b188cb32e5531d0f8d3af9506f8959cb369e (excl.) affected from cde001e4c3c3625c60b68a83eb1f1c2572dee07a to a9e886f73dd717027028bb7e3bbca93601ecdfc7 (excl.) affected from cde001e4c3c3625c60b68a83eb1f1c2572dee07a to 39a31ad9e2a5ed7e9c9c6f711dca96c8c8f5f26b (excl.) Version f60b0fa8bbddde66f1d197be07120264b555c84a is affected affected from 3.12.44 to 3.13 (excl.)

Vendor	Linux
Product	Linux
Versions	Default: affected Version 4.1 is affected unaffected from 0 to 4.1 (excl.) unaffected from 5.10.261 to 5.10.* (incl.) unaffected from 5.15.212 to 5.15.* (incl.) unaffected from 6.1.178 to 6.1.* (incl.) unaffected from 6.6.145 to 6.6.* (incl.) unaffected from 6.12.96 to 6.12.* (incl.) unaffected from 6.18.39 to 6.18.* (incl.) unaffected from 7.1.4 to 7.1.* (incl.) unaffected from 7.2-rc1 to * (incl.)