A use-after-free vulnerability in the Linux kernel loongson-rng driver allows local authenticated attackers to achieve high levels of system compromise.

This flaw involves a use-after-free vulnerability within the crypto loongson-rng module due to improper use of wait_for_completion_interruptible, requiring low-level local privileges.

A successful exploit of this vulnerability could allow a local attacker with low privileges to compromise the integrity, confidentiality, and availability of the affected system. With a CVSS score of 7.8, the severity is categorized as high, presenting significant risk regarding unauthorized privilege escalation or system instability in multi-tenant or shared environments.

Immediate Action: Update the Linux kernel to version 6.18.39, 7.1.4, or later where the vulnerable loongson-rng driver has been removed.

Proactive Monitoring: Monitor system logs for unexpected kernel panics, segmentation faults, or resource exhaustion that may indicate exploitation attempts targeting memory management.

Compensating Controls: Restrict local shell access and implement strict principle of least privilege policies to prevent untrusted users from executing arbitrary code locally.

Public Exploit Available: false

Given the high severity score and potential for system compromise, administrators must prioritize updating affected Linux kernel instances. Applying the vendor provided patches or upgrading to a secure kernel release is critical to neutralizing the underlying use-after-free vector.