Bug 2536452 (CVE-2026-93157)

Summary:	CVE-2026-93157 kernel: hwrng: xilinx-trng - propagate timeout before any data is read
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the `xilinx-trng` hardware random number generator (HWRNG) driver in the Linux kernel. The `xtrng_readblock32()` function can incorrectly indicate a successful read even when a timeout occurs and no random data has been produced. This can result in the kernel processing incomplete or zero-byte data as valid random output. The consequence is that systems relying on this driver may utilize random numbers of compromised quality, potentially impacting the security of cryptographic operations or other functions dependent on true random data.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-17 17:58:10 UTC

In the Linux kernel, the following vulnerability has been resolved:

hwrng: xilinx-trng - propagate timeout before any data is read

xtrng_readblock32() polls for 16-byte chunks but returns the number of
bytes read even when the first poll times out. Its caller then treats a
zero return as a short successful read, and partial reads for full
32-byte blocks can make the tail copy use a fixed block offset rather
than the amount already produced.

Return the poll error when no data has been read, preserve partial
positive returns after some data is available, stop the generator on all
collection exits, and append tail bytes at the current output count.

Comment 1 gkamathe 2026-09-18 21:51:22 UTC

Upstream advisory:
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93157.mbox