PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46075 Linux CVE debrief

A use-after-free (UAF) and memory leak vulnerability exists in the Linux kernel's Atmel SHA204A cryptographic driver. The issue occurs during device removal when the hardware random number generator (hwrng) is not properly unregistered before teardown, allowing queued I2C workqueue callbacks to execute after the device structure has been freed. Additionally, an early return path prevents proper cleanup of sysfs entries and the hwrng private data structure, resulting in a memory leak. The fix unregisters the hwrng to block new read operations, flushes the I2C workqueue to ensure pending callbacks complete, and removes the early return to guarantee complete resource cleanup.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-24
Advisory published
2026-05-27
Advisory updated
2026-06-24

Who should care

Organizations running Linux systems with Atmel SHA204A cryptographic hardware, particularly embedded systems and IoT devices utilizing this secure element for hardware random number generation. Cloud providers and kernel maintainers responsible for stable kernel backports should prioritize this fix.

Technical summary

The atmel-sha204a driver in the Linux kernel fails to properly synchronize device removal with pending I2C workqueue operations. The hwrng is not unregistered before teardown, allowing concurrent ->read() calls and queued callbacks to access freed memory. An early return bypasses sysfs entry removal and hwrng.priv deallocation. The resolution unregisters the hwrng first, flushes the I2C workqueue to drain pending operations, and ensures all cleanup paths execute by removing the early return.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits when available for your distribution
  • For systems using the Atmel SHA204A hardware random number generator, prioritize patching if the device undergoes frequent hotplug or removal operations
  • Monitor vendor security advisories for kernel package updates addressing this CVE
  • Review system logs for any hwrng-related errors during device removal that may indicate trigger conditions

Evidence notes

The vulnerability description is sourced from the official CVE record published by NVD on 2026-05-27. The fix involves unregistering the hwrng, flushing the Atmel I2C workqueue, and removing an early return path to ensure proper cleanup. Multiple stable kernel commits are referenced indicating backports to affected versions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46075 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46075

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46075 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46075

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1193c12126d39bf986a5a9214827b73707b193ab

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/31901371ccd16b42d2f167b1018ba9ae8bd5a6c7

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/775c00d87c385b758da9504cf053acea00e2ed40

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/bab1adf3b87e4bfac92c4f5963c63db434d561c1

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c5a45d14234bf26e28a89e3a5dcc08336595cf11

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.