CVE-2026-46075: crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path

Q: What conditions trigger the unsafe teardown?

The risk arises when the Atmel SHA204A device is being removed while a queued Atmel I2C workqueue callback can still run, or while new hwrng read calls can be initiated. This can lead to use-after-free during device teardown.

Q: What level of attacker access is required?

The vulnerability is locally exploitable with low privileges and does not require user interaction. The supplied vector indicates an availability impact, with no reported confidentiality or integrity impact.

Q: What should the corrected remove path do?

It should unregister the hwrng before teardown, flush the Atmel I2C workqueue, and avoid the early return so that sysfs entries are removed and hwrng.priv is freed. These steps prevent new reads, queued callbacks using freed memory, and the associated memory leak.

Published May 27, 2026

Updated

crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path

Affected Software

7 affected componentsFixes available

Linux Linux kernel (atmel-sha204a)

Linux Linux kernel>=5.3<6.1.175

Linux Linux kernel>=6.2<6.6.140

Linux Linux kernel>=6.7<6.12.86

Linux Linux kernel>=6.13<6.18.27

Linux Linux kernel>=6.19<7.0.4

Microsoft azl3 kernel 6.6.139.1-1<6.6.141.1-1

6.6.141.1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1

Event History

May 27, 2026

CVE Published

via MITRE·12:58 PM

Data Sourced

via MITRE·12:58 PM

Description

Data Sourced

via NVD·02:17 PM

RemedyDescriptionSeverityWeaknessAffected Software

May 28, 2026

Data Sourced

via Microsoft·08:02 AM

DescriptionSeverityWeakness

Data Sourced

via Microsoft·08:02 AM

Affected Software

Updated

via Microsoft·08:02 AM

DescriptionSeverity

Frequently Asked Questions

What conditions trigger the unsafe teardown?

The risk arises when the Atmel SHA204A device is being removed while a queued Atmel I2C workqueue callback can still run, or while new hwrng read calls can be initiated. This can lead to use-after-free during device teardown.

What level of attacker access is required?

The vulnerability is locally exploitable with low privileges and does not require user interaction. The supplied vector indicates an availability impact, with no reported confidentiality or integrity impact.

What should the corrected remove path do?

It should unregister the hwrng before teardown, flush the Atmel I2C workqueue, and avoid the early return so that sysfs entries are removed and hwrng.priv is freed. These steps prevent new reads, queued callbacks using freed memory, and the associated memory leak.

CVE-2026-46075: crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions trigger the unsafe teardown?

What level of attacker access is required?

What should the corrected remove path do?

Company

Resources

Contact

Frequently Asked Questions

What conditions trigger the unsafe teardown?

What level of attacker access is required?

What should the corrected remove path do?