CVE-2026-45949 Overview
CVE-2026-45949 is a use-after-free vulnerability in the Linux kernel's hardware random number generator (hwrng) core subsystem. The flaw stems from a race condition between hwrng_register() and hwrng_unregister() involving the global hwrng_fill pointer. Because hwrng_unregister() reads hwrng_fill outside the rng_mutex lock, concurrent unregister operations can invoke kthread_stop() twice on the same task. The defect can also manifest when hwrng_unregister() runs immediately after hwrng_register(), leaving hwrng_fill pointing at a freed task_struct. The result is a kernel refcount warning and a use-after-free condition observed in code paths such as virtrng_remove().
Critical Impact
A use-after-free in the hwrng core can corrupt kernel memory, trigger refcount saturation warnings, and lead to kernel instability or potential local privilege escalation on systems using hardware RNG drivers such as virtio-rng.
Affected Products
- Linux kernel drivers/char/hw_random/core.c (hwrng core)
- Systems using hardware RNG drivers including virtio-rng (virtrng_remove path)
- Distributions shipping affected stable kernel branches prior to the referenced fix commits
Discovery Timeline
- 2026-05-27 - CVE-2026-45949 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45949
Vulnerability Analysis
The vulnerability resides in the Linux kernel hwrng core, specifically in the lifecycle handling of the hwrng_fillfn() kernel thread. The global hwrng_fill pointer references the task running hwrng_fillfn(). The original code only cleared hwrng_fill after the thread exited, but hwrng_unregister() read this pointer without holding rng_mutex. Two threads racing on unregister could therefore both observe a non-NULL pointer and each call kthread_stop() on the same task, decrementing its refcount past zero.
A second failure mode occurs when hwrng_unregister() runs immediately after hwrng_register(). The fill thread may not yet have executed, so hwrng_fill remains set after unregister returns. Subsequent hwrng_register() calls cannot start new threads, and the next hwrng_unregister() invokes kthread_stop() on a freed task_struct. The kernel logs refcount_t: addition on 0; use-after-free and warns at lib/refcount.c:25 with a stack including kthread_stop+0x181/0x360 and hwrng_unregister+0x288/0x380.
Root Cause
The root cause is missing synchronization around the global hwrng_fill pointer and the current_rng reference. Read and write access to these shared structures was not consistently serialized under rng_mutex, allowing two control paths to operate on the same kernel task concurrently. The defect is classified as a race condition leading to use-after-free.
Attack Vector
Exploitation requires the ability to trigger hardware RNG device registration and removal cycles, such as repeated attach and detach of a virtio-rng device or rapid driver load and unload. Local privileged operations that bind or unbind the driver can race the kernel thread lifecycle and cause the freed-task dereference. The vulnerability is a local kernel issue rather than a network-reachable flaw.
The kernel patch resolves the race by protecting hwrng_fill under rng_mutex, converting current_rng to RCU so get_current_rng() can read it without the lock, deferring cleanup in put_rng() to a work_struct, and moving the kthread_stop() call into drop_current_rng() so it executes on every path where current_rng becomes NULL. The hwrng_fillfn() thread now calls schedule() after current_rng is dropped to remain alive until kthread_stop() runs.
Detection Methods for CVE-2026-45949
Indicators of Compromise
- Kernel log entries containing refcount_t: addition on 0; use-after-free originating from refcount_warn_saturate
- Stack traces showing kthread_stop called from hwrng_unregister or virtrng_remove
- Repeated WARN_ON splats in lib/refcount.c correlated with hardware RNG driver bind or unbind events
Detection Strategies
- Monitor dmesg and /var/log/messages for refcount saturation warnings tied to hwrng_unregister
- Inventory running kernels against the fixed commits referenced in the Kernel Git Commit Update advisories
- Audit virtualization hosts and guests using virtio-rng for kernel versions lacking the RCU and work_struct fix
Monitoring Recommendations
- Forward kernel ring buffer telemetry to a centralized logging platform and alert on refcount_warn_saturate patterns
- Track driver bind and unbind events under /sys/bus/virtio/drivers/virtio_rng for unexpected churn
- Correlate kernel WARN events with workload changes such as VM lifecycle operations
How to Mitigate CVE-2026-45949
Immediate Actions Required
- Apply the upstream stable kernel updates that include the hwrng core RCU and work_struct fix
- Reboot affected hosts after package updates so the patched kernel is loaded
- Restrict permissions to driver bind and unbind interfaces under /sys/bus/*/drivers/ to root-only access
Patch Information
The fix is committed across multiple Linux stable branches. Refer to the following kernel commits: ad38f2cdfef9, cc2f39d6ac48, d5b7730f0699, and dcf416eb88ea. Update via the distribution's kernel package channel.
Workarounds
- Avoid rapid load and unload cycles of hardware RNG drivers, including virtio_rng, on unpatched kernels
- Disable or blacklist virtio_rng where hardware RNG is not required, using modprobe.d configuration
- Limit local privileged access that can trigger device hotplug operations against RNG devices
# Configuration example: blacklist virtio_rng on unpatched hosts until kernel is updated
echo 'blacklist virtio_rng' | sudo tee /etc/modprobe.d/blacklist-virtio-rng.conf
sudo update-initramfs -u
# Verify kernel version after patching
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
