CVE-2026-74402

A flaw was found in the Linux kernel's atmel-sha204a cryptographic hardware random number generator (HWRNG) driver. Improper buffer management in both blocking and non-blocking paths causes the driver to fail in providing valid entropy. This occurs because the buffer is read starting from byte 1, and only a partial amount of random data is fetched from the return message. Consequently, cryptographic operations relying on this hardware random number generator may be weakened due to insufficient randomness.

A moderate-impact flaw was found in the Linux kernel's atmel-sha204a cryptographic hardware random number generator (HWRNG) driver. Improper buffer management in both the blocking and non-blocking read paths caused the driver to fail to provide valid entropy: the response buffer was read starting at byte 1 instead of byte 0, and only part of the 32 bytes of random data in the device's return message was fetched. On systems equipped with an Atmel SHA204A HWRNG device, reads from /dev/hwrng could therefore return reduced or predictable data, weakening cryptographic operations that depend on this hardware random number generator. The issue is limited to kernels containing the atmel-sha204a driver used with the corresponding Atmel hardware. Red Hat Enterprise Linux and Red Hat In-Vehicle OS are not affected by this flaw because the vulnerable code is not present in the shipped kernel packages for the listed streams.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.