{"id":"CVE-2026-64306","title":"crypto: drbg - Fix returning success on failure in CTR_DRBG","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: drbg - Fix returning success on failure in CTR_DRBG\n\ndrbg_ctr_generate() sometimes returns success when it fails, leaving the\noutput buffer uninitialized.  Fix it.","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a < 074db6db03a0aaa78f05ca9d4838053713796665","Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a < 7b03312491f9fe6ba4d60c4023e7e61d2d1fed96","Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a < 75597e8774f319152744d24e0683d9393540a951","Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a < cc42fb40171c249bb859071d81b4eb007398a0bc","Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a < bbbac12083eff489b35d848332f0dff311131344","Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a < 23b8b188cb32e5531d0f8d3af9506f8959cb369e","Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a < a9e886f73dd717027028bb7e3bbca93601ecdfc7","Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a < 39a31ad9e2a5ed7e9c9c6f711dca96c8c8f5f26b","Linux f60b0fa8bbddde66f1d197be07120264b555c84a","Linux >= 3.12.44 < 3.13","Linux 4.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:34:29.433082Z"},"published":"2026-07-25","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:44:43.965Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64306","references":[{"url":"https://git.kernel.org/stable/c/074db6db03a0aaa78f05ca9d4838053713796665"},{"url":"https://git.kernel.org/stable/c/7b03312491f9fe6ba4d60c4023e7e61d2d1fed96"},{"url":"https://git.kernel.org/stable/c/75597e8774f319152744d24e0683d9393540a951"},{"url":"https://git.kernel.org/stable/c/cc42fb40171c249bb859071d81b4eb007398a0bc"},{"url":"https://git.kernel.org/stable/c/bbbac12083eff489b35d848332f0dff311131344"},{"url":"https://git.kernel.org/stable/c/23b8b188cb32e5531d0f8d3af9506f8959cb369e"},{"url":"https://git.kernel.org/stable/c/a9e886f73dd717027028bb7e3bbca93601ecdfc7"},{"url":"https://git.kernel.org/stable/c/39a31ad9e2a5ed7e9c9c6f711dca96c8c8f5f26b"}],"tags":["cve.org"],"epss":0.0016,"epssPercentile":0.05198,"ingestedAt":"2026-11-06T16:57:43.204Z","slug":"CVE-2026-64306","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: drbg - Fix returning success on failure in CTR_DRBG\n\ndrbg_ctr_generate() sometimes returns success when it fails, leaving the\noutput buffer uninitialized.  Fix it.\n\n## Affected\n\n- `Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a < 074db6db03a0aaa78f05ca9d4838053713796665`\n- `Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a < 7b03312491f9fe6ba4d60c4023e7e61d2d1fed96`\n- `Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a < 75597e8774f319152744d24e0683d9393540a951`\n- `Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a < cc42fb40171c249bb859071d81b4eb007398a0bc`\n- `Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a < bbbac12083eff489b35d848332f0dff311131344`\n- `Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a < 23b8b188cb32e5531d0f8d3af9506f8959cb369e`\n- `Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a < a9e886f73dd717027028bb7e3bbca93601ecdfc7`\n- `Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a < 39a31ad9e2a5ed7e9c9c6f711dca96c8c8f5f26b`\n- `Linux f60b0fa8bbddde66f1d197be07120264b555c84a`\n- `Linux >= 3.12.44 < 3.13`\n- `Linux 4.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}