CVE-2026-45949VulnerabilityPublished 28 May 2026Updated 24 Sep 2026

Microsoft · hwrng: core - use RCU and work_struct to fix race condition

Affects MicrosoftSource GCVE Database

Compare

Authoritative record:CVE-2026-45949· High

Not known to be exploited · fixed in dcf416eb88eafe1e3c0f920a14bdffd10bc4d259 : patch Microsoft soon.

Data as of 29 Oct 2026, 19:04 UTC

Severity

High

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.08% chance of exploitation in 30 days – higher than 0% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in dcf416eb88eafe1e3c0f920a14bdffd10bc4d259, d5b7730f06994499632026c30e38e0317c4569e2, cc2f39d6ac48e6e3cb2d6240bc0d6df839dd0828 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 27 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 29 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

microsoft-security-response-ce

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ be4000bc4644d027c519b6361f5ae3bbfc52c347, < dcf416eb88eafe1e3c0f920a14bdffd10bc4d259	Fixed in dcf416eb88eafe1e3c0f920a14bdffd10bc4d259
LinuxLinux	Affected ≥ be4000bc4644d027c519b6361f5ae3bbfc52c347, < d5b7730f06994499632026c30e38e0317c4569e2	Fixed in d5b7730f06994499632026c30e38e0317c4569e2
LinuxLinux	Affected ≥ be4000bc4644d027c519b6361f5ae3bbfc52c347, < cc2f39d6ac48e6e3cb2d6240bc0d6df839dd0828	Fixed in cc2f39d6ac48e6e3cb2d6240bc0d6df839dd0828
LinuxLinux	Affected ≥ be4000bc4644d027c519b6361f5ae3bbfc52c347, < ad38f2cdfef9a2f2899c30cad269baec5bfd4a5d	Fixed in ad38f2cdfef9a2f2899c30cad269baec5bfd4a5d
LinuxLinux	Affected ≥ be4000bc4644d027c519b6361f5ae3bbfc52c347, < 1cde96d5d53b9105b48617afbc4682a83db4ff04	Fixed in 1cde96d5d53b9105b48617afbc4682a83db4ff04
LinuxLinux	Affected =3.17	Fixed in–

Description

CVE-2026-45949 is a vulnerability related to a race condition in the hwrng core component, which is addressed by using RCU and work_struct mechanisms. The vulnerability affects Microsoft products including Azure Linux 3.0. No CVSS score is provided, and there are no known exploits in the wild. The description provided is minimal and does not specify exploitation methods or impact beyond the race condition fix.

Impact

The impact is related to a race condition in the hardware random number generator core, which could potentially affect system reliability or security. However, no specific impact details or exploitation scenarios are provided. No known exploits in the wild have been reported.

Summary

This vulnerability involves a race condition in the hwrng core component of Microsoft products such as Azure Linux 3.0. The fix involves using Read-Copy-Update (RCU) and work_struct to address the race condition. The vendor advisory does not provide detailed technical information or patch status. No known exploits have been reported.

CWE-362Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition) (opens in a new tab)
Class weaknessLikelihood of exploit: MediumOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
Architecture and Design
In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
Architecture and Design
Use thread-safe capabilities such as the data access abstraction in Spring.
Architecture and Design
Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
Secure Design Principles (opens in a new tab)
OWASP ASVS 4.0.3
V1.11.2 (opens in a new tab)
Attack patterns
Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions (opens in a new tab)
Leveraging Race Conditions (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 28 May 2026, 21:06 UTC

WeaknessesCWE-362

Technical details

References

Community reviews

Related threats