CVE-2026-80835

A flaw was found in the Linux kernel's qcom-rng driver. This driver, responsible for generating random numbers, allowed two of its interfaces to operate simultaneously without proper synchronization. This oversight could lead to the generation of predictable or non-random values, potentially compromising cryptographic operations and other security features relying on true randomness.

The qcom rng driver exposed the same hardware RNG through both crypto_rng and hwrng interfaces without common synchronization for accesses to the shared hardware registers. Concurrent generation through qcom_rng_generate() and qcom_hwrng_read() can cause repeated output or non random values, which may weaken cryptographic material that depends on this RNG. For the CVSS the PR:L is used because a local user or local process is needed to trigger the crypto_rng side through AF_ALG while hwrng activity is present. The issue is not directly network reachable. Impact is not a kernel crash but possible confidentiality and integrity degradation through weakened randomness. The base score uses low C and I impact, while the paranoid score treats RNG output degradation as potentially high impact in deployments where the affected RNG contributes to keys, nonces, or tokens.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.