CVE-2026-93157

What it actually does

The xtrng_readblock32 function in the Xilinx TRNG driver returns byte counts on poll timeout before any data is read, causing callers to misinterpret zero returns as partial successes and use fixed offsets for tail copies instead of tracking produced bytes, resulting in corrupted RNG output or improper generator shutdown.

Why it matters to the business

Systems relying on this hardware RNG for cryptographic operations face risks of weakened randomness, which can undermine encryption, key generation, and secure boot processes on affected Xilinx-based Linux deployments.

How an attack unfolds

An attacker triggers poll timeout conditions during RNG block reads to force incorrect return values and offset calculations, allowing manipulation or prediction of subsequent random data streams used by the kernel or applications.

How to fix it

Apply the upstream Linux kernel patch that returns poll errors on zero-data reads, preserves partial returns correctly, stops the generator on all exits, and uses current output counts for tail bytes.

How to confirm the fix worked

Inspect the xilinx-trng driver source to confirm xtrng_readblock32 now checks for initial poll failure before returning counts and updates tail append logic to use produced byte offsets.

Typical attack path

1. Locate Linux systems with Xilinx TRNG hardware enabled
2. Induce or wait for poll timeout events in xtrng_readblock32
3. Observe or influence RNG consumers to leverage incorrect tail byte handling
4. Extract or predict values from the resulting flawed random output

How to detect it

Review kernel logs for xilinx-trng timeout messages or repeated short reads from /dev/hwrng; correlate with cryptographic failures or entropy pool warnings in dmesg or system logs.

What your security team should do

• Prioritize kernel updates for any Xilinx FPGA or SoC deployments using this driver
• Audit RNG usage in cryptographic libraries and applications
• Enable alternative entropy sources such as other hwrng modules or jitterentropy
• Monitor kernel RNG interfaces for anomalous behavior post-update