CVE-2026-93163 in Linux
Summary
by MITRE • 09/18/2026
In the Linux kernel, the following vulnerability has been resolved:
hwrng: core - fix rng list on registration error
hwrng_register(rng) does the following:
1. Checks if rng has name and read methods set 2. Checks if the name already exists 3. Adds rng to global rng_list 4. May try to set rng to current_rng
If step 4 fails, it returns an error. However, it does not remove the rng from rng_list, causing a dangling reference which can result in use-after-free if the caller frees rng, since registration failed.
Add a list_del_init() cleanup step.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The Linux kernel hardware random number generator subsystem contains a critical logic error within its core registration mechanism that leads to memory safety violations under specific failure conditions. The hwrng_register function is responsible for integrating new hardware RNG drivers into the global system state, ensuring they are available for cryptographic operations and entropy collection. This process involves several sequential steps: first validating that the driver provides necessary name and read methods, then checking for naming conflicts with existing registered devices, followed by adding the device to a global linked list known as rng_list, and finally attempting to designate it as the current default RNG source if no other is active or preferred.
The vulnerability arises from an incomplete error handling path during this registration sequence. Specifically, when the function successfully adds the random number generator structure to the global rng_list in step three but subsequently fails in step four while attempting to set it as the current_rng due to validation errors or resource constraints, the function returns a negative error code indicating failure. Crucially, however, the implementation neglects to reverse the list insertion performed earlier. This omission leaves the device structure embedded within the global rng_list despite the registration operation being reported as failed to the caller.
This architectural flaw results in a dangling pointer scenario where the kernel maintains references to an object that is effectively unregistered and potentially invalid from the perspective of system management tools, yet remains accessible through internal lists. If the calling driver or module proceeds to free its allocated memory for the rng structure upon receiving this error code, it will deallocate memory blocks that are still referenced by the global rng_list maintained by the kernel core. Subsequent operations within the kernel that iterate over the rng_list to query available entropy sources or select a default RNG may attempt to dereference these freed pointers.
The operational impact of this use-after-free vulnerability is severe, potentially leading to system instability, kernel panics, or arbitrary code execution depending on how the corrupted memory state is exploited by an attacker. An adversary with local access could theoretically trigger repeated registration failures followed by deallocation cycles to manipulate heap structures and achieve privilege escalation. This flaw aligns with CWE-416, which describes use-after-free vulnerabilities resulting from improper resource cleanup after failed operations. It also relates to CWE-20 regarding improper input validation that allows for inconsistent state management within the kernel subsystem.
From a threat modeling perspective using the MITRE ATT&CK framework, this vulnerability facilitates initial access and privilege escalation techniques by allowing attackers to exploit memory corruption bugs in high-privilege contexts such as the Linux kernel. The lack of proper cleanup after partial success represents a common pattern in systems programming errors that can be leveraged for exploitation without requiring complex bypasses against modern mitigations like KASLR or stack canaries, provided the attacker can control the timing and content of subsequent allocations to overwrite freed memory regions with malicious payloads.
To mitigate this vulnerability, developers must ensure that all resource acquisitions are strictly paired with corresponding release operations in every code path, including error paths. The fix involves inserting a list_del_init call immediately before returning an error from hwrng_register if the device has already been added to the global list but subsequent steps fail. This ensures that the rng structure is completely removed from the kernel's internal tracking structures before control returns to the caller, preventing any future dereferences of freed memory. System administrators should apply kernel updates containing this patch promptly to eliminate the risk of local privilege escalation through heap corruption in the hardware random number generator subsystem.