It is a bug in kernels older than 3.13 that they overestimate the available entropy, which is at least theoretically is a security hole. See http://git.kernel.org/linus/30e37ec516ae5a6957596de7661673c615c82ea4 for the gory mathematical details. This presumably refers to patch 30e37ec516ae5a6957596de7661673c615c82ea4 which was included in the Linux 3.13 kernel; its prerequisites are 9ed17b70b409dc48c134a80b5a6df582ba759de2 and a283b5c459784f9762a74c312b134e9a524f5a5f.
