CVE-2026-93163

A flaw was found in the hwrng core component of the Linux kernel. When the hwrng_register function fails during the registration process, it does not properly remove the hardware random number generator (RNG) from the global list. This oversight creates a dangling reference, which can lead to a use-after-free vulnerability if the caller subsequently attempts to free the RNG. A local attacker could potentially exploit this to cause a denial of service or achieve arbitrary code execution.

This vulnerability is rated as Moderate because exploitation requires local access and depends on specific error conditions during hardware random number generator device registration, limiting the threat primarily to a kernel crash. In standard Red Hat Enterprise Linux deployments, hardware RNG components are initialized by privileged subsystem routines during system boot or physical hardware detection. Unprivileged users cannot directly trigger registration failures or manipulate the core RNG device tables, substantially restricting potential attack vectors in production environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.