CVE-2026-45949

A flaw was found in the Linux kernel's hardware random number generator (hwrng) core. A race condition exists where concurrent or rapid calls to the hwrng_unregister() function can lead to a use-after-free vulnerability. This issue allows the system to attempt to access freed memory, potentially causing system instability or, in severe cases, enabling a local attacker to achieve privilege escalation or execute arbitrary code.

A race in the hwrng core can leave the global hwrng_fill task pointer stale across fast hwrng_register and hwrng_unregister sequences. This can make hwrng_unregister call kthread_stop on the same task twice or on a task_struct that has already been freed, producing a real use after free in a kernel thread lifetime path. For the CVSS the PR:H is used because reliable triggering normally requires privileged hardware RNG device management, module unload, driver unbind, or hotplug control rather than ordinary local user access. The issue is not network reachable and reading from /dev/hwrng alone is not the relevant trigger path. Impact is primarily availability through kernel warning or crash. Limited confidentiality and integrity impact are kept only for the paranoid interpretation because the bug is a real UAF, but the patch does not show controlled reclaim, arbitrary write, or a strong LPE primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.