Executive brief
A vulnerability was identified in the Linux kernel's Atmel SHA204A crypto driver that could lead to system instability or memory leaks. The SHA204A is a hardware component used for secure authentication and random number generation. If the driver is removed while the device is busy, it could cause a 'use-after-free' error, potentially crashing the system or allowing unauthorized memory access.
Technical details
A race condition exists in the 'atmel-sha204a' driver's remove path. Specifically, the driver failed to unregister the hardware random number generator (hwrng) and flush the Atmel I2C workqueue before teardown. This allows queued callbacks to execute after the device structure has been freed, leading to a use-after-free (UAF). Additionally, an early return logic in the removal function prevented sysfs entries from being cleaned up and private data from being freed, resulting in a memory leak. The fix involves unregistering the hwrng, flushing the workqueue, and ensuring all cleanup paths are executed regardless of the device's busy state.
Affected products
- Linux Linux kernel Fixed in various stable branches including 1193c12, 3190137, 775c00d, bab1adf, c5a45d1
Timeline
- 2026-05-27: advisory: NVD publication date
- 2026-03-22: patched: Initial patch by Herbert Xu
References
- https://git.kernel.org/stable/c/1193c12126d39bf986a5a9214827b73707b193ab
- https://git.kernel.org/stable/c/31901371ccd16b42d2f167b1018ba9ae8bd5a6c7
- https://git.kernel.org/stable/c/775c00d87c385b758da9504cf053acea00e2ed40
- https://git.kernel.org/stable/c/bab1adf3b87e4bfac92c4f5963c63db434d561c1
- https://git.kernel.org/stable/c/c5a45d14234bf26e28a89e3a5dcc08336595cf11