CVE-2026-93163

Source
https://cve.org/CVERecord?id=CVE-2026-93163
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93163.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-93163
Downstream
Related
Published
2026-09-17T16:11:56Z
Modified
2026-10-08T02:52:33Z
Summary
hwrng: core - fix rng list on registration error
Details

In the Linux kernel, the following vulnerability has been resolved:

hwrng: core - fix rng list on registration error

hwrng_register(rng) does the following:

  1. Checks if rng has name and read methods set
  2. Checks if the name already exists
  3. Adds rng to global rng_list
  4. May try to set rng to current_rng

If step 4 fails, it returns an error. However, it does not remove the rng from rng_list, causing a dangling reference which can result in use-after-free if the caller frees rng, since registration failed.

Add a list_del_init() cleanup step.

Database specific
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93163.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
2bbb6983887fefc8026beab01198d30f47b7bd22
Fixed
de4f1bcb61a73cc896decdbd27d61a34add93b53
Fixed
cf293c9c7424de0d04b51367d07f40570ce80231
Fixed
bee8d1fcdc8f389b595b0a4cf6fe8440f499458a
Fixed
3a5834db2b1ce25649f330e78efe1ccde78967fd
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4.9.320
Fixed
4.10
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
42802952a2725f85f7e36ee3b29593af5fe87197

Affected versions

v4.*
v4.9.320
v4.9.321
v4.9.322
v4.9.323
v4.9.324
v4.9.325
v4.9.326
v4.9.327
v4.9.328
v4.9.329
v4.9.330
v4.9.331
v4.9.332
v4.9.333
v4.9.334
v4.9.335
v4.9.336
v4.9.337

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93163.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.14.0
Fixed
6.12.110
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.52
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.6

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93163.json"