CVE-2026-93163: hwrng: core - fix rng list on registration error
In the Linux kernel, the following vulnerability has been resolved:
hwrng: core - fix rng list on registration error
hwrngregister(rng) does the following:
1. Checks if rng has name and read methods set 2. Checks if the name already exists 3. Adds rng to global rnglist 4. May try to set rng to currentrng
If step 4 fails, it returns an error. However, it does not remove the rng from rnglist, causing a dangling reference which can result in use-after-free if the caller frees rng, since registration failed.
Add a listdelinit() cleanup step.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement the described cleanup and registration logic so that when registration fails the rng is not left on rng_list, avoiding dangling references if the caller frees rng.
Linux kernel hwrng_register(rng) rng_list registration cleanup behavior = On registration error: add list_del_init() cleanup and only add rng to global rng_list after validating rng has name and read methods; check for existing name; if step 4 fails, return an error without leaving rng on rng_list. - Compensating control
Apply the Linux kernel hwrng core fix: ensure hwrng_register(rng) correctly handles rng_list registration failures to prevent a dangling reference / potential use-after-free (named as 'hwrng: core - fix rng list on registration error' and 'May try to set rng to current_rng').
Event History
Frequently Asked Questions
What condition triggers the dangling reference?
The issue occurs when hwrng_register() successfully adds an RNG to the global rng_list but then fails while attempting to make that RNG the current_rng. The registration call returns an error without removing the RNG from the list.
What must happen for this to become a use-after-free?
After the registration failure, the caller must free the RNG object. The stale entry left in rng_list can then be dereferenced, resulting in a use-after-free.
What does the fix change?
The fix adds a list_del_init() cleanup operation when setting the current RNG fails, removing the failed registration from rng_list before returning the error.