VulnerabilityPublished 17 Sep 2026Updated 30 Oct 2026

CVE-2026-93163: Linux kernel · hwrng: core – fix rng list on registration error

Source GCVE Database

Compare

Authoritative record:CVE-2026-93163· High

Not known to be exploited · fixed in e37c67f768234e14cd6ea3b081568dd915c5b67e : patch Linux kernel soon.

Data as of 30 Oct 2026, 18:18 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in e37c67f768234e14cd6ea3b081568dd915c5b67e, de4f1bcb61a73cc896decdbd27d61a34add93b53, cf293c9c7424de0d04b51367d07f40570ce80231 +4

Exploitation evidence

Disclosed: evidence found.
CVE published 17 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-22cg-3qr6-xx65

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected >=4.9.320 <4.10	Fixed in e37c67f768234e14cd6ea3b081568dd915c5b67e de4f1bcb61a73cc896decdbd27d61a34add93b53 cf293c9c7424de0d04b51367d07f40570ce80231 bee8d1fcdc8f389b595b0a4cf6fe8440f499458a 30b2cc2966dac87ee95a99c49e28486c2a8129cd 4.10 3a5834db2b1ce25649f330e78efe1ccde78967fd
LinuxLinux	Affected =4.14	Fixed in–

AI-suggested

A fix has been implemented in the Linux kernel to properly clean up the RNG list on registration errors by removing the dangling reference. Users should apply the official kernel updates that include this fix once available. Until patched, cautious handling of RNG device registration is advised.

Description

A use-after-free vulnerability in the Linux kernel's hardware random number generator (hwrng) core was fixed. The issue occurs when the registration of a new RNG device fails after it has been added to the global list but before completion, leaving a dangling reference. This can lead to memory corruption if the caller frees the RNG object after a failed registration.

Impact

This vulnerability can lead to use-after-free memory corruption in the Linux kernel, which may cause system instability or potential escalation of privileges if exploited. However, there is no indication of known exploits in the wild at this time.

Summary

The vulnerability in the Linux kernel's hwrng core arises from improper cleanup on registration error in the hwrng_register function. Specifically, if setting the current RNG fails after adding the RNG device to the global rng_list, the device is not removed from the list, resulting in a dangling pointer. This dangling reference can cause a use-after-free condition if the caller frees the RNG device after the failed registration. The fix involves adding a list_del_init() call to properly remove the RNG device from the list upon registration failure.

References

Community reviews

Loading reviews…