CVE-2026-64306 - Vulnerability Details

- crypto: drbg - Fix returning success on failure in CTR_DRBG

Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: drbg - Fix returning success on failure in CTR_DRBG

drbg_ctr_generate() sometimes returns success when it fails, leaving the
output buffer uninitialized. Fix it.

Published: 2026-07-25

Score: 7.0 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`cde001e4c3c3625c60b68a83eb1f1c2572dee07a`	affected	< 074db6db03a0aaa78f05ca9d4838053713796665
`cde001e4c3c3625c60b68a83eb1f1c2572dee07a`	affected	< 7b03312491f9fe6ba4d60c4023e7e61d2d1fed96
`cde001e4c3c3625c60b68a83eb1f1c2572dee07a`	affected	< 75597e8774f319152744d24e0683d9393540a951
`cde001e4c3c3625c60b68a83eb1f1c2572dee07a`	affected	< cc42fb40171c249bb859071d81b4eb007398a0bc
`cde001e4c3c3625c60b68a83eb1f1c2572dee07a`	affected	< bbbac12083eff489b35d848332f0dff311131344
`cde001e4c3c3625c60b68a83eb1f1c2572dee07a`	affected	< 23b8b188cb32e5531d0f8d3af9506f8959cb369e
`cde001e4c3c3625c60b68a83eb1f1c2572dee07a`	affected	< a9e886f73dd717027028bb7e3bbca93601ecdfc7
`cde001e4c3c3625c60b68a83eb1f1c2572dee07a`	affected	< 39a31ad9e2a5ed7e9c9c6f711dca96c8c8f5f26b
`f60b0fa8bbddde66f1d197be07120264b555c84a`	affected	—
`3.12.44`	affected	< 3.13

Linux

affected

Version	Status	Constraints
`4.1`	affected	—
`0`	unaffected	< 4.1
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.96`	unaffected	≤ 6.12.*
`6.18.39`	unaffected	≤ 6.18.*
`7.1.4`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[cde001e4c3c3625c60b68a83eb1f1c2572dee07a,074db6db03a0aaa78f05ca9d4838053713796665)`	affected	code_commit	—
`[cde001e4c3c3625c60b68a83eb1f1c2572dee07a,7b03312491f9fe6ba4d60c4023e7e61d2d1fed96)`	affected	code_commit	—
`[cde001e4c3c3625c60b68a83eb1f1c2572dee07a,75597e8774f319152744d24e0683d9393540a951)`	affected	code_commit	—
`[cde001e4c3c3625c60b68a83eb1f1c2572dee07a,cc42fb40171c249bb859071d81b4eb007398a0bc)`	affected	code_commit	—
`[cde001e4c3c3625c60b68a83eb1f1c2572dee07a,bbbac12083eff489b35d848332f0dff311131344)`	affected	code_commit	—
`[cde001e4c3c3625c60b68a83eb1f1c2572dee07a,23b8b188cb32e5531d0f8d3af9506f8959cb369e)`	affected	code_commit	—
`[cde001e4c3c3625c60b68a83eb1f1c2572dee07a,a9e886f73dd717027028bb7e3bbca93601ecdfc7)`	affected	code_commit	—
`[cde001e4c3c3625c60b68a83eb1f1c2572dee07a,39a31ad9e2a5ed7e9c9c6f711dca96c8c8f5f26b)`	affected	code_commit	—
`f60b0fa8bbddde66f1d197be07120264b555c84a`	affected	code_commit	—
`[3.12.44,3.13)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.1`	affected	semver	—
`[0,4.1)`	unaffected	semver	—
`[5.10.261,5.10.*]`	unaffected	generic	—
`[5.15.212,5.15.*]`	unaffected	generic	—
`[6.1.178,6.1.*]`	unaffected	generic	—
`[6.6.145,6.6.*]`	unaffected	generic	—
`[6.12.96,6.12.*]`	unaffected	generic	—
`[6.18.39,6.18.*]`	unaffected	generic	—
`[7.1.4,7.1.*]`	unaffected	generic	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00211.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/074db6db03a0aaa78f05ca9d4838053713796665
https://git.kernel.org/stable/c/23b8b188cb32e5531d0f8d3af9506f8959cb369e
https://git.kernel.org/stable/c/39a31ad9e2a5ed7e9c9c6f711dca96c8c8f5f26b
https://git.kernel.org/stable/c/75597e8774f319152744d24e0683d9393540a951
https://git.kernel.org/stable/c/7b03312491f9fe6ba4d60c4023e7e61d2d1fed96
https://git.kernel.org/stable/c/a9e886f73dd717027028bb7e3bbca93601ecdfc7
https://git.kernel.org/stable/c/bbbac12083eff489b35d848332f0dff311131344
https://git.kernel.org/stable/c/cc42fb40171c249bb859071d81b4eb007398a0bc
https://lore.kernel.org/linux-cve-announce/2026072508-CVE-2026-64306-62d1@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64306
https://www.cve.org/CVERecord?id=CVE-2026-64306

History

Thu, 30 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026072508-CVE-2026-64306-62d1@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64306 https://www.cve.org/CVERecord?id=CVE-2026-64306
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Tue, 28 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-758

Sat, 25 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: crypto: drbg - Fix returning success on failure in CTR_DRBG drbg_ctr_generate() sometimes returns success when it fails, leaving the output buffer uninitialized. Fix it.
Title		crypto: drbg - Fix returning success on failure in CTR_DRBG
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/074db6db03a0aaa78f05ca9d4838053713796665 https://git.kernel.org/stable/c/23b8b188cb32e5531d0f8d3af9506f8959cb369e https://git.kernel.org/stable/c/39a31ad9e2a5ed7e9c9c6f711dca96c8c8f5f26b https://git.kernel.org/stable/c/75597e8774f319152744d24e0683d9393540a951 https://git.kernel.org/stable/c/7b03312491f9fe6ba4d60c4023e7e61d2d1fed96 https://git.kernel.org/stable/c/a9e886f73dd717027028bb7e3bbca93601ecdfc7 https://git.kernel.org/stable/c/bbbac12083eff489b35d848332f0dff311131344 https://git.kernel.org/stable/c/cc42fb40171c249bb859071d81b4eb007398a0bc

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T08:49:40.153Z

Updated: 2026-07-25T08:49:40.153Z

Reserved: 2026-07-19T15:36:31.779Z

Link: CVE-2026-64306

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64306 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-28T16:15:05Z

Weaknesses

CWE-758
Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object