CVE-2026-80871

What it actually does

Race condition in xilinx-trng driver where xtrng_trng_generate() and xtrng_hwrng_trng_read() can execute concurrently due to broken locking, combined with xtrng_trng_generate() returning success on partial byte fills.

Why it matters to the business

Potential generation of weak or incomplete random data that could undermine cryptographic operations or security protocols relying on hardware randomness from this driver.

How an attack unfolds

An attacker triggers concurrent calls to the affected TRNG functions to exploit the broken locking, causing interference that results in either truncated random output or corrupted state, allowing observation or prediction of RNG values.

How to fix it

Update to a Linux kernel version that removes the crypto_rng interface from the xilinx-trng driver, eliminating the vulnerable code paths entirely.

How to confirm the fix worked

Confirm the driver source no longer implements xtrng_trng_generate() or registers with crypto_rng, and verify absence of the described locking and partial-fill issues in the remaining hwrng code path.

Typical attack path

1. Identify system using xilinx-trng hardware RNG
2. Trigger concurrent access to crypto_rng and hwrng interfaces
3. Force xtrng_trng_generate() to return success on incomplete output
4. Consume resulting RNG data for cryptographic operations or observation

How to detect it

Review kernel logs for concurrent TRNG access warnings or errors from xilinx-trng; inspect calls to crypto_rng registration and any partial buffer handling in driver traces.

What your security team should do

• Apply the kernel update removing the interface as soon as available
• Audit any user-space code directly invoking the crypto_rng interface on this driver
• Monitor for upstream stable backports addressing the race and partial-output bugs