CVE intelligence

CVE-2026-80833

Vulnerability intelligence

Published Sep 4, 2026Sources checked Oct 27, 2026

N/ACVSS not listedScore unavailable

What this means

Review the available evidence

CVE-2026-80833. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Microsoft Security Response Center guidance

Vendor revision: Sep 7, 2026

See the Microsoft Security Update Guide for the update that applies to your product.

CISA KEVNot listedBased on the latest collected catalog

EPSS0.2%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-80833?

In the Linux kernel, the following vulnerability has been resolved:

crypto: sun8i-ss - Remove crypto_rng interface

Since the crypto_rng interface for hardware PRNGs is unused and is redundant with hwrng and the actual Linux RNG, it's being phased out. Most drivers for it were already removed.

Go ahead and remove the sun8i-ss support which is one of the only remaining ones.

As usual for crypto_rng, this driver was also buggy: its ->generate() function had a use-after-free vulnerability due to using wait_for_completion_interruptible_timeout() without handling shutting down the DMA operation if a signal is sent. Also, it had a buffer overread bug in the line 'memcpy(ctx->seed, d + dlen, ctx->slen);'.

There's no point in fixing these bugs separately only to remove the code anyway, so this commit is marked with Fixes and Cc stable.

Source: NVD