CVE-2026-93157: Linux kernel · hwrng: xilinx-trng – propagate timeout before any data is read
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in bdc3b37a935f28c3e9eb2f6e889b4644d859fb08 : update Linux kernel when convenient.
Data as of 26 Oct 2026, 14:32 UTC
Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in bdc3b37a935f28c3e9eb2f6e889b4644d859fb08, ba088974419326daf46c5dc03e2cf6ab6ab701f7, 62219775a07ce0bd8085852f3d1e2d772bf6fdec
Exploitation evidence
Disclosed: evidence found.
CVE published 17 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Linux kernel to bdc3b37a935f28c3e9eb2f6e889b4644d859fb08, ba088974419326daf46c5dc03e2cf6ab6ab701f7 or 62219775a07ce0bd8085852f3d1e2d772bf6fdec.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
The issue has been fixed in the Linux kernel. Users should update to a fixed kernel version containing commits bdc3b37a935f28c3e9eb2f6e889b4644d859fb08, ba088974419326daf46c5dc03e2cf6ab6ab701f7, or 62219775a07ce0bd8085852f3d1e2d772bf6fdec. Applying these patches or upgrading to a kernel version including these fixes will remediate the vulnerability.
Description
A vulnerability in the Linux kernel's hwrng xilinx-trng driver causes improper handling of timeouts during random number generation reads. The function xtrng_readblock32() may incorrectly return a byte count even when the initial poll times out, leading to incorrect processing of partial reads and potential data corruption. The issue has been fixed by ensuring poll errors are returned when no data is read, preserving partial reads correctly, stopping the generator on all exits, and properly appending tail bytes.