Executive brief
A vulnerability was identified in the Linux kernel's hardware random number generator (hwrng) component. This component is responsible for gathering high-quality random data from hardware sources, which is essential for encryption and security operations. An exploit could cause a system crash or instability (denial of service) by triggering a race condition during the registration or unregistration of hardware devices.
Technical details
A use-after-free vulnerability exists in the Linux kernel hwrng core due to a race condition between hwrng_register() and hwrng_unregister(). The root cause is that hwrng_fill is accessed outside of the rng_mutex lock, allowing concurrent unregistration attempts to call kthread_stop() on the same task or on a task that has already been freed. This occurs particularly when unregistration happens immediately after registration before the filler thread has executed. The fix involves protecting the global hwrng_fill pointer with the rng_mutex, converting current_rng to use RCU (Read-Copy-Update) to avoid deadlocks, and utilizing work_struct for delayed cleanup. Patch availability is confirmed via multiple git.kernel.org commits.
Affected products
- Linux Linux kernel All versions prior to the fix in 2026
Timeline
- 2026-01-30: other: Patch authored by Lianjie Wang
- 2026-05-27: disclosed: CVE-2026-45949 published
- 2026-05-27: advisory