CVE-2026-93157: hwrng: xilinx-trng - propagate timeout before any data is read
In the Linux kernel, the following vulnerability has been resolved:
hwrng: xilinx-trng - propagate timeout before any data is read
xtrngreadblock32() polls for 16-byte chunks but returns the number of bytes read even when the first poll times out. Its caller then treats a zero return as a short successful read, and partial reads for full 32-byte blocks can make the tail copy use a fixed block offset rather than the amount already produced.
Return the poll error when no data has been read, preserve partial positive returns after some data is available, stop the generator on all collection exits, and append tail bytes at the current output count.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel's Xilinx TRNG hardware random-number generator driver are exposed. The issue is in the driver's handling of polling timeouts and partial reads.
What conditions are needed to trigger the problem?
The TRNG must experience a timeout before data is read, or a partial read while collecting a requested 32-byte block. These conditions can cause an initial timeout to be treated as a short successful read or tail data to be copied using an incorrect offset.
What should operators do if they cannot immediately apply the fix?
The provided data does not describe a configuration workaround. Prioritize updating to a kernel containing the referenced fixes, particularly on systems that rely on the Xilinx TRNG driver.