VulnerabilityPublished 27 May 2026Updated 21 Oct 2026

CVE-2026-45949: Linux kernel · hwrng: core – use RCU and work_struct to fix race condition

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in dcf416eb88eafe1e3c0f920a14bdffd10bc4d259 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 17:30 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.08% chance of exploitation in 30 days – higher than 0% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in dcf416eb88eafe1e3c0f920a14bdffd10bc4d259, d5b7730f06994499632026c30e38e0317c4569e2, cc2f39d6ac48e6e3cb2d6240bc0d6df839dd0828 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 27 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ be4000bc4644d027c519b6361f5ae3bbfc52c347, < dcf416eb88eafe1e3c0f920a14bdffd10bc4d259	Fixed in dcf416eb88eafe1e3c0f920a14bdffd10bc4d259
LinuxLinux	Affected ≥ be4000bc4644d027c519b6361f5ae3bbfc52c347, < d5b7730f06994499632026c30e38e0317c4569e2	Fixed in d5b7730f06994499632026c30e38e0317c4569e2
LinuxLinux	Affected ≥ be4000bc4644d027c519b6361f5ae3bbfc52c347, < cc2f39d6ac48e6e3cb2d6240bc0d6df839dd0828	Fixed in cc2f39d6ac48e6e3cb2d6240bc0d6df839dd0828
LinuxLinux	Affected ≥ be4000bc4644d027c519b6361f5ae3bbfc52c347, < ad38f2cdfef9a2f2899c30cad269baec5bfd4a5d	Fixed in ad38f2cdfef9a2f2899c30cad269baec5bfd4a5d
LinuxLinux	Affected ≥ be4000bc4644d027c519b6361f5ae3bbfc52c347, < 1cde96d5d53b9105b48617afbc4682a83db4ff04	Fixed in 1cde96d5d53b9105b48617afbc4682a83db4ff04
LinuxLinux	Affected =3.17	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: hwrng: core - use RCU and work_struct to fix race condition Currently, hwrng_fill is not cleared until the hwrng_fillfn() thread exits. Since hwrng_unregister() reads hwrng_fill outside the rng_mutex lock, a concurrent hwrng_unregister() may call kthread_stop() again on the same task. Additionally, if hwrng_unregister() is called immediately after hwrng_register(), the stopped thread may have never been executed. Thus, hwrng_fill remains dirty even after hwrng_unregister() returns. In this case, subsequent calls to hwrng_register() will fail to start new threads, and hwrng_unregister() will call kthread_stop() on the same freed task. In both cases, a use-after-free occurs: refcount_t: addition on 0; use-after-free. WARNING: ... at lib/refcount.c:25 refcount_warn_saturate+0xec/0x1c0 Call Trace: kthread_stop+0x181/0x360 hwrng_unregister+0x288/0x380 virtrng_remove+0xe3/0x200 This patch fixes the race by protecting the global hwrng_fill pointer inside the rng_mutex lock, so that hwrng_fillfn() thread is stopped only once, and calls to kthread_run() and kthread_stop() are serialized with the lock held. To avoid deadlock in hwrng_fillfn() while being stopped with the lock held, we convert current_rng to RCU, so that get_current_rng() can read current_rng without holding the lock. To remove the lock from put_rng(), we also delay the actual cleanup into a work_struct. Since get_current_rng() no longer returns ERR_PTR values, the IS_ERR() checks are removed from its callers. With hwrng_fill protected by the rng_mutex lock, hwrng_fillfn() can no longer clear hwrng_fill itself. Therefore, if hwrng_fillfn() returns directly after current_rng is dropped, kthread_stop() would be called on a freed task_struct later. To fix this, hwrng_fillfn() calls schedule() now to keep the task alive until being stopped. The kthread_stop() call is also moved from hwrng_unregister() to drop_current_rng(), ensuring kthread_stop() is called on all possible paths where current_rng becomes NULL, so that the thread would not wait forever.

References

Community reviews

Loading reviews…