Executive brief
The Linux kernel's Xilinx True Random Number Generator (TRNG) driver contains a logic error in its timeout handling that could return incorrect or incomplete random data to callers. When the hardware times out during data collection, the driver incorrectly reports success instead of propagating the error, potentially leading to callers receiving truncated or malformed random bytes for cryptographic operations.
Technical details
The vulnerability exists in the xilinx-trng hardware random number generator driver's xtrng_readblock32() function. The function polls the hardware for 16-byte chunks of random data but fails to properly propagate timeout errors to its caller when no data has been read. Instead, it returns zero (treated as a short but successful read), allowing the xtrng_collect_random_data() function to incorrectly interpret the failure as a partial success. This causes subsequent operations to use wrong buffer offsets and potentially return incomplete or corrupted random data. The fix changes the return type from size_t to int, enabling error propagation, and corrects the buffer management logic to track actual bytes collected.
Affected products
- Linux Linux kernel multiple versions (patch addresses hwrng driver)
Timeline
- 2026-09-17: disclosed: Published to NVD
- 2026-07-05: patched: Upstream patch committed (ba0889744) by Herbert Xu