« Volver al listado

CVE-2026-93163

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

hwrng: core - fix rng list on registration error

hwrng_register(rng) does the following:

1. Checks if rng has name and read methods set 2. Checks if the name already exists 3. Adds rng to global rng_list 4. May try to set rng to current_rng

If step 4 fails, it returns an error. However, it does not remove the rng from rng_list, causing a dangling reference which can result in use-after-free if the caller frees rng, since registration failed.

Add a list_del_init() cleanup step.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-93163",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2bbb6983887fefc8026beab01198d30f47b7bd22",
              "lessThan": "de4f1bcb61a73cc896decdbd27d61a34add93b53",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2bbb6983887fefc8026beab01198d30f47b7bd22",
              "lessThan": "cf293c9c7424de0d04b51367d07f40570ce80231",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2bbb6983887fefc8026beab01198d30f47b7bd22",
              "lessThan": "bee8d1fcdc8f389b595b0a4cf6fe8440f499458a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2bbb6983887fefc8026beab01198d30f47b7bd22",
              "lessThan": "3a5834db2b1ce25649f330e78efe1ccde78967fd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "42802952a2725f85f7e36ee3b29593af5fe87197",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4.9.320",
              "lessThan": "4.10",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "drivers/char/hw_random/core.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.14",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/char/hw_random/core.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:18:11.763",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/3a5834db2b1ce25649f330e78efe1ccde78967fd",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bee8d1fcdc8f389b595b0a4cf6fe8440f499458a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cf293c9c7424de0d04b51367d07f40570ce80231",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/de4f1bcb61a73cc896decdbd27d61a34add93b53",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwrng: core - fix rng list on registration error\n\nhwrng_register(rng) does the following:\n\n1. Checks if rng has name and read methods set\n2. Checks if the name already exists\n3. Adds rng to global rng_list\n4. May try to set rng to current_rng\n\nIf step 4 fails, it returns an error. However, it does not remove the\nrng from rng_list, causing a dangling reference which can result in\nuse-after-free if the caller frees rng, since registration failed.\n\nAdd a list_del_init() cleanup step."
    }
  ],
  "lastModified": "2026-09-17T17:18:11.763",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}