---
id: CVE-2026-64306
title: 'crypto: drbg - Fix returning success on failure in CTR_DRBG'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  crypto: drbg - Fix returning success on failure in CTR_DRBG

  drbg_ctr_generate() sometimes returns success when it fails, leaving the
  output buffer uninitialized.  Fix it.
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a <
    074db6db03a0aaa78f05ca9d4838053713796665
  - >-
    Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a <
    7b03312491f9fe6ba4d60c4023e7e61d2d1fed96
  - >-
    Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a <
    75597e8774f319152744d24e0683d9393540a951
  - >-
    Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a <
    cc42fb40171c249bb859071d81b4eb007398a0bc
  - >-
    Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a <
    bbbac12083eff489b35d848332f0dff311131344
  - >-
    Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a <
    23b8b188cb32e5531d0f8d3af9506f8959cb369e
  - >-
    Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a <
    a9e886f73dd717027028bb7e3bbca93601ecdfc7
  - >-
    Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a <
    39a31ad9e2a5ed7e9c9c6f711dca96c8c8f5f26b
  - Linux f60b0fa8bbddde66f1d197be07120264b555c84a
  - Linux >= 3.12.44 < 3.13
  - Linux 4.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:34:29.433082Z'
published: '2026-07-25'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:44:43.965Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64306'
references:
  - url: 'https://git.kernel.org/stable/c/074db6db03a0aaa78f05ca9d4838053713796665'
  - url: 'https://git.kernel.org/stable/c/7b03312491f9fe6ba4d60c4023e7e61d2d1fed96'
  - url: 'https://git.kernel.org/stable/c/75597e8774f319152744d24e0683d9393540a951'
  - url: 'https://git.kernel.org/stable/c/cc42fb40171c249bb859071d81b4eb007398a0bc'
  - url: 'https://git.kernel.org/stable/c/bbbac12083eff489b35d848332f0dff311131344'
  - url: 'https://git.kernel.org/stable/c/23b8b188cb32e5531d0f8d3af9506f8959cb369e'
  - url: 'https://git.kernel.org/stable/c/a9e886f73dd717027028bb7e3bbca93601ecdfc7'
  - url: 'https://git.kernel.org/stable/c/39a31ad9e2a5ed7e9c9c6f711dca96c8c8f5f26b'
tags:
  - cve.org
epss: 0.0016
epssPercentile: 0.05198
ingestedAt: '2026-11-06T16:57:43.204Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

crypto: drbg - Fix returning success on failure in CTR_DRBG

drbg_ctr_generate() sometimes returns success when it fails, leaving the
output buffer uninitialized.  Fix it.

## Affected

- `Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a < 074db6db03a0aaa78f05ca9d4838053713796665`
- `Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a < 7b03312491f9fe6ba4d60c4023e7e61d2d1fed96`
- `Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a < 75597e8774f319152744d24e0683d9393540a951`
- `Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a < cc42fb40171c249bb859071d81b4eb007398a0bc`
- `Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a < bbbac12083eff489b35d848332f0dff311131344`
- `Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a < 23b8b188cb32e5531d0f8d3af9506f8959cb369e`
- `Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a < a9e886f73dd717027028bb7e3bbca93601ecdfc7`
- `Linux >= cde001e4c3c3625c60b68a83eb1f1c2572dee07a < 39a31ad9e2a5ed7e9c9c6f711dca96c8c8f5f26b`
- `Linux f60b0fa8bbddde66f1d197be07120264b555c84a`
- `Linux >= 3.12.44 < 3.13`
- `Linux 4.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.