Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-45949— hwrng: core - use RCU and work_struct to fix race condition

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于hwrng核心模块中hwrng_fill的清理与线程停止存在竞争条件，可能导致释放后重用。

AI Predicted 7.8 Difficulty: Moderate EPSS 0.09% · P0

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 10

VendorProduct Version RangeStatus
Linux Linux be4000bc4644d027c519b6361f5ae3bbfc52c347< d5b7730f06994499632026c30e38e0317c4569e2 affected
be4000bc4644d027c519b6361f5ae3bbfc52c347< dcf416eb88eafe1e3c0f920a14bdffd10bc4d259 affected
be4000bc4644d027c519b6361f5ae3bbfc52c347< ad38f2cdfef9a2f2899c30cad269baec5bfd4a5d affected
be4000bc4644d027c519b6361f5ae3bbfc52c347< cc2f39d6ac48e6e3cb2d6240bc0d6df839dd0828 affected
3.17 affected
< 3.17 unaffected
6.12.75≤ 6.12.* unaffected
6.18.14≤ 6.18.* unaffected
… +2 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-45949

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
hwrng: core - use RCU and work_struct to fix race condition
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: hwrng: core - use RCU and work_struct to fix race condition Currently, hwrng_fill is not cleared until the hwrng_fillfn() thread exits. Since hwrng_unregister() reads hwrng_fill outside the rng_mutex lock, a concurrent hwrng_unregister() may call kthread_stop() again on the same task. Additionally, if hwrng_unregister() is called immediately after hwrng_register(), the stopped thread may have never been executed. Thus, hwrng_fill remains dirty even after hwrng_unregister() returns. In this case, subsequent calls to hwrng_register() will fail to start new threads, and hwrng_unregister() will call kthread_stop() on the same freed task. In both cases, a use-after-free occurs: refcount_t: addition on 0; use-after-free. WARNING: ... at lib/refcount.c:25 refcount_warn_saturate+0xec/0x1c0 Call Trace: kthread_stop+0x181/0x360 hwrng_unregister+0x288/0x380 virtrng_remove+0xe3/0x200 This patch fixes the race by protecting the global hwrng_fill pointer inside the rng_mutex lock, so that hwrng_fillfn() thread is stopped only once, and calls to kthread_run() and kthread_stop() are serialized with the lock held. To avoid deadlock in hwrng_fillfn() while being stopped with the lock held, we convert current_rng to RCU, so that get_current_rng() can read current_rng without holding the lock. To remove the lock from put_rng(), we also delay the actual cleanup into a work_struct. Since get_current_rng() no longer returns ERR_PTR values, the IS_ERR() checks are removed from its callers. With hwrng_fill protected by the rng_mutex lock, hwrng_fillfn() can no longer clear hwrng_fill itself. Therefore, if hwrng_fillfn() returns directly after current_rng is dropped, kthread_stop() would be called on a freed task_struct later. To fix this, hwrng_fillfn() calls schedule() now to keep the task alive until being stopped. The kthread_stop() call is also moved from hwrng_unregister() to drop_current_rng(), ensuring kthread_stop() is called on all possible paths where current_rng becomes NULL, so that the thread would not wait forever.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于hwrng核心模块中hwrng_fill的清理与线程停止存在竞争条件，可能导致释放后重用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux be4000bc4644d027c519b6361f5ae3bbfc52c347 ~ d5b7730f06994499632026c30e38e0317c4569e2 -
Linux Linux 3.17 -

II. Public POCs for CVE-2026-45949

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-45949

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-45949 (4)

Same Patch Batch · Linux · 2026-05-27 · 275 CVEs total

CVE-2026-45972 9.8 CRITICAL smb: client: fix potential UAF and double free in smb2_open_file()
CVE-2026-46039 9.8 CRITICAL rxgk: Fix potential integer overflow in length check
CVE-2026-45898 9.8 CRITICAL RDMA/iwcm: Fix workqueue list corruption by removing work_list
CVE-2026-45988 9.8 CRITICAL rxrpc: Fix re-decryption of RESPONSE packets
CVE-2026-46043 9.1 CRITICAL RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
CVE-2026-46056 8.8 HIGH Bluetooth: hci_event: fix potential UAF in SSP passkey handlers
CVE-2026-45945 8.8 HIGH iommu/vt-d: Fix race condition during PASID entry replacement
CVE-2026-46037 8.2 HIGH ipv4: icmp: validate reply type before using icmp_pointers
CVE-2025-71311 8.2 HIGH fs/ntfs3: Initialize new folios before use
CVE-2026-45843 8.2 HIGH slip: bound decode() reads against the compressed packet length
CVE-2026-46099 8.1 HIGH net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels
CVE-2026-46010 8.1 HIGH rxrpc: Fix error handling in rxgk_extract_token()
CVE-2026-46076 7.9 HIGH KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
CVE-2026-45931 7.8 HIGH accel/amdxdna: Hold mm structure across iommu_sva_unbind_device()
CVE-2026-45878 7.8 HIGH drm/amdkfd: Fix watch_id bounds checking in debug address watch v2
CVE-2026-46036 7.8 HIGH vfio/cdx: Serialize VFIO_DEVICE_SET_IRQS with a per-device mutex
CVE-2026-46065 7.8 HIGH fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info
CVE-2026-45910 7.8 HIGH RDMA/rxe: Fix race condition in QP timer handlers
CVE-2026-45959 7.8 HIGH crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree
CVE-2026-45909 7.8 HIGH clk: mediatek: Drop __initconst from gates

Showing top 20 of 275 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-45949

No comments yet

Leave a comment