The Linux kernel contained a vulnerability in the CTR_DRBG deterministic random bit generator implementation. Specifically, the function drbg_ctr_generate() sometimes returned a success status even when it failed to generate random data, resulting in the output buffer remaining uninitialized. This could cause cryptographic operations relying on this output to use invalid or predictable data. The vulnerability has been fixed by ensuring the function correctly signals failure and does not leave the output buffer uninitialized.

If exploited, this vulnerability could cause cryptographic operations to use uninitialized or invalid random data, potentially weakening cryptographic guarantees. However, no known exploits are reported in the wild. The impact is limited to cryptographic operations relying on the affected CTR_DRBG implementation in the Linux kernel.

A fix has been implemented in the Linux kernel to correct the return status of drbg_ctr_generate() and prevent returning success on failure. Users should apply the official Linux kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory for current remediation guidance.