Executive brief
The Linux kernel's Qualcomm random number generator driver exposed the same hardware through two separate interfaces (crypto_rng and hwrng) without proper synchronization between them. This allowed concurrent access to shared hardware registers, potentially producing repeated, predictable, or non-random output. The fix removes the unused crypto_rng interface to eliminate the race condition and simplify the code.
Technical details
The qcom-rng.c driver implemented a race condition (CWE-362) where the qcom_rng_generate() function synchronized only with itself via a mutex, but not with the qcom_hwrng_read() function, even though both accessed the same hardware registers. An attacker with local access to trigger concurrent RNG operations through the crypto_rng AF_ALG socket interface and hwrng interface simultaneously could exploit this to obtain predictable or repeated random values. The crypto_rng interface is not actually used in practice (only by the AF_ALG "rng" algorithm type which has no real-world consumers), so the fix simply removes it entirely, leaving only the hwrng interface which is the actively maintained path. The patch was committed upstream in June 2026 and backported to stable branches by September 2026.
Affected products
- Linux Linux kernel versions containing qcom-rng driver with crypto_rng interface
Timeline
- 2026-06-08: disclosed
- 2026-07-05: patched
- 2026-09-04: advisory