CVE-2026-93163

What it actually does

The hwrng_register function adds an rng to the global rng_list before attempting to set it as current_rng; on failure of that step it returns an error without removing the entry, leaving a dangling reference that becomes a use-after-free when the caller subsequently frees the rng structure.

Why it matters to the business

On systems exposing hardware RNG registration paths, successful exploitation could lead to kernel memory corruption, crashes, or potential local privilege escalation, increasing operational risk and requiring urgent patching of affected Linux kernels.

How an attack unfolds

An attacker with local access crafts or triggers an rng registration that passes name/read checks and list insertion but fails the current_rng assignment, forces the caller to free the rng, then induces kernel code paths that walk the now-stale rng_list entry to trigger the use-after-free.

How to fix it

Apply the upstream fix that inserts list_del_init() before returning the error from hwrng_register; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Inspect the hwrng.c source for the added list_del_init() call on the error path after current_rng assignment failure; confirm the running kernel contains the corrected registration logic via source or binary diff.

Typical attack path

1. Obtain local execution or module-loading capability on the target kernel
2. Trigger hwrng_register with an rng that satisfies initial validation but fails current_rng assignment
3. Ensure the rng structure is freed after the failed registration
4. Force iteration or dereference of the rng_list to access the freed object

How to detect it

Review kernel logs and crash dumps for hwrng_register error paths followed immediately by use-after-free or list corruption reports; correlate with any custom RNG module load events.

What your security team should do

• Apply the hwrng registration fix in the next kernel update cycle
• Audit any custom or out-of-tree RNG drivers that call hwrng_register
• Monitor kernel oops and panic logs for hwrng-related use-after-free signatures