Cloudanix VulnDB

CVE-2026-93159

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in a hardware random number generator driver could let programs on the same machine see pieces of internal system memory that should have stayed private.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Stale heap pointer left in hwrng->priv after failed async I2C transfer allows subsequent nonblocking reads to interpret freed or reused memory as valid RNG output, leaking prior heap contents.

Why it matters to the business

Systems relying on the Atmel SHA204A RNG may expose sensitive kernel memory contents to local processes, increasing risk of information disclosure on affected Linux kernels.

How an attack unfolds

An attacker with local access triggers repeated I2C failures against the hardware RNG while monitoring or forcing nonblocking read paths; the uncleared pointer causes later reads to return residual heap data that may contain credentials or other kernel objects.

How to fix it

Apply the upstream kernel patch that frees work_data and clears rng->priv on I2C failure; rebuild and deploy the fixed kernel image to all affected systems.

How to confirm the fix worked

Confirm the presence of the fix by inspecting the atmel-sha204a driver source for the explicit kfree and rng->priv = NULL sequence in the error path of the completion callback; verify no warning-only failure paths remain.

Typical attack path

  1. Obtain local unprivileged access on a system using atmel-sha204a RNG
  2. Force or wait for I2C transfer failures in the nonblocking RNG path
  3. Issue nonblocking RNG reads that consume the stale work_data pointer
  4. Inspect returned data for leaked heap contents from prior allocations

How to detect it

Search kernel logs for atmel-sha204a warning messages about I2C transfer failures immediately preceding unexpected RNG output or hwrng activity; inspect process accounting for repeated opens of the RNG device by untrusted users.

What your security team should do

  • Prioritize kernel updates containing this fix on all systems exposing the Atmel SHA204A RNG
  • Audit local access controls and RNG usage to reduce attack surface until patched
  • Monitor kernel logs for atmel-sha204a I2C errors correlated with RNG activity

The record

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a - fix heap info leak on I2C transfer failure The nonblocking RNG path allocates a work_data structure to track the state of an in-flight asynchronous I2C request. This pointer is stored in rng->priv and later consumed by the read path once the transaction completes. If the underlying I2C transfer fails, the completion callback is invoked with a non-zero status. In this case, the allocated work_data is not usable for producing RNG output and must not remain associated with the hwrng state. Previously, the failure path only logged a warning but left the pointer state uncleared, which can result in subsequent read attempts observing stale state and interpreting it as valid completion data. Fix this by freeing the pending work_data. The I2C transaction reports an error. This ensures that failed requests do not leave residual state behind that could be interpreted as valid RNG data on later reads. Clearing rng->priv is done at the subsequent call to nonblocking read.

Affected packages

Ecosystem Package Introduced Fixed