CVE-2026-45949

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

hwrng: core - use RCU and work_struct to fix race condition

Currently, hwrng_fill is not cleared until the hwrng_fillfn() thread

exits. Since hwrng_unregister() reads hwrng_fill outside the rng_mutex

lock, a concurrent hwrng_unregister() may call kthread_stop() again on

the same task.

Additionally, if hwrng_unregister() is called immediately after

hwrng_register(), the stopped thread may have never been executed. Thus,

hwrng_fill remains dirty even after hwrng_unregister() returns. In this

case, subsequent calls to hwrng_register() will fail to start new

threads, and hwrng_unregister() will call kthread_stop() on the same

freed task. In both cases, a use-after-free occurs:

refcount_t: addition on 0; use-after-free.

WARNING: ... at lib/refcount.c:25 refcount_warn_saturate+0xec/0x1c0

Call Trace:

kthread_stop+0x181/0x360

hwrng_unregister+0x288/0x380

virtrng_remove+0xe3/0x200

This patch fixes the race by protecting

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References