CVE-2026-93159

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

crypto: atmel-sha204a - fix heap info leak on I2C transfer failure

The nonblocking RNG path allocates a work_data structure to track the

state of an in-flight asynchronous I2C request. This pointer is stored

in rng->priv and later consumed by the read path once the transaction

completes.

If the underlying I2C transfer fails, the completion callback is invoked

with a non-zero status. In this case, the allocated work_data is not

usable for producing RNG output and must not remain associated with the

hwrng state.

Previously, the failure path only logged a warning but left the pointer

state uncleared, which can result in subsequent read attempts observing

stale state and interpreting it as valid completion data.

Fix this by freeing the pending work_data. The I2C transaction reports

an error. This ensures that failed requests do not leave residual state

behind that could be interpreted as valid RNG data on later reads.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References