Linux Kernel CVE-2026-74438

Exploitation requires all of the following conditions to be met simultaneously: (1) local shell access with at least low-privilege user credentials, as confirmed by CVSS PR:L - remote exploitation is not possible; (2) the target system must be physically running AllWinner sun4i SoC hardware (A10, A13, A20, or compatible) with the sun4i-ss kernel module present and loaded - this excludes all x86, mainstream ARM Cortex-A (non-Allwinner), RISC-V, and cloud VM deployments; (3) the kernel must have CONFIG_CRYPTO_DEV_SUN4I_SS compiled in or available as a loadable module; (4) the attacker must invoke the 'rng' algorithm type via a custom PF_ALG/AF_ALG socket - no standard userspace application is known to do this, so exploitation requires purpose-built attack tooling. Exploitation is further constrained by the race condition in sun4i_ss_prng_seed() requiring timing control. There is no network-facing attack vector, no browser or service that reaches this subsystem, and no known legitimate dependency on this code path.

Despite a CVSS 3.1 score of 7.8 HIGH with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, multiple converging signals substantially reduce real-world risk: EPSS of 0.18% at the 8th percentile indicates extremely low observed exploitation activity, the vulnerability is absent from CISA KEV, and no public exploit code exists. The hardware dependency is the most significant limiting factor - only systems physically running AllWinner sun4i SoC hardware with the sun4i-ss driver loaded can reach this code path, which excludes the vast majority of x86, ARM Cortex-A (non-AllWinner), and cloud-based Linux deployments. Even a mid-sized municipal IT team in gniezno managing commodity x86 server infrastructure would have zero affected systems in their estate. The kernel maintainers' own assessment - removing dead code rather than patching - implicitly confirms that no production workload is known to use this PRNG path, and no threat actor is believed to have targeted it. The CVSS score accurately reflects the theoretical severity of a kernel buffer overflow but overstates actionable risk for any organization not specifically operating AllWinner sun4i embedded boards. There is no conflict between CVSS vector and description; local access is consistent with the AF_ALG interface model.

An attacker with a local shell on an AllWinner sun4i-based ARM device (such as a Cubietruck or similar SBC running a vulnerable kernel) writes a custom program that opens an AF_ALG socket of type 'rng', calls the seed operation with a buffer exceeding the expected size, and triggers the bounds-check-absent copy in sun4i_ss_prng_seed() while a concurrent thread races on the missing lock. The resulting kernel heap or stack corruption may overwrite adjacent kernel structures, enabling privilege escalation from an unprivileged user to root. No public proof-of-concept exploit exists at time of analysis.