CVE-2026-46075 Overview
CVE-2026-46075 is a Linux kernel vulnerability in the atmel-sha204a crypto driver. The flaw exists in the device remove path, where the hardware random number generator (hwrng) is not properly unregistered before teardown. A queued Atmel I2C workqueue callback can run while the device is being removed, creating a potential use-after-free (UAF) condition. The same code path also contains an early return that skips sysfs entry removal and the freeing of ->hwrng.priv, producing a memory leak. Maintainers resolved the issue by unregistering the hwrng, flushing the Atmel I2C workqueue before teardown, and removing the early return.
Critical Impact
A race between the device removal path and queued hwrng or I2C callbacks can lead to kernel memory corruption through use-after-free, alongside persistent memory leaks of driver state.
Affected Products
- Linux kernel builds including the atmel-sha204a crypto driver
- Systems integrating Atmel/Microchip ATSHA204A secure elements over I2C
- Stable kernel branches referenced by the upstream fix commits
Discovery Timeline
- 2026-05-27 - CVE-2026-46075 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-46075
Vulnerability Analysis
The atmel-sha204a driver exposes the ATSHA204A secure element as a Linux hardware random number generator. During module or device removal, the driver tears down internal state without first unregistering the hwrng. New ->read() calls and previously queued Atmel I2C workqueue callbacks can still execute against structures that the remove path is freeing. This produces a classic use-after-free [CWE-416] window on kernel objects associated with the hwrng and I2C transactions.
A second defect in the same function is an early return that bypasses cleanup logic. Sysfs entries created by the driver remain registered, and the buffer referenced by ->hwrng.priv is never freed, resulting in a memory leak [CWE-401] on every probe/remove cycle.
Root Cause
The remove path lacked an explicit hwrng_unregister() call and did not flush the Atmel I2C workqueue before releasing driver-owned memory. The early return short-circuited the rest of the cleanup, leaving sysfs nodes and ->hwrng.priv allocations in place after the underlying device was gone.
Attack Vector
Triggering the condition requires the device removal code path to execute concurrently with a pending hwrng read or queued I2C work item. This is typically reachable on systems where the driver can be unbound, the module unloaded, or the device hot-removed while user-space or kernel consumers are still requesting random bytes from the hwrng interface. No verified public exploit is available for this issue.
No verified public exploit code is available. Refer to the upstream patches for the precise sequence of operations introduced into the remove path.
Detection Methods for CVE-2026-46075
Indicators of Compromise
- Kernel oops, KASAN use-after-free reports, or general protection faults referencing atmel_sha204a, hwrng_core, or Atmel I2C workqueue functions during driver unbind or module unload.
- kmemleak reports identifying unfreed allocations tied to hwrng.priv in the atmel-sha204a driver.
- Lingering sysfs entries under the driver's device node after the device has been removed.
Detection Strategies
- Enable CONFIG_KASAN and CONFIG_DEBUG_KMEMLEAK on test kernels to surface UAF and memory leak conditions in the atmel-sha204a remove path.
- Compare running kernel versions against the fixed commits 1193c12126, 31901371cc, 775c00d87c, bab1adf3b8, and c5a45d1423 to identify unpatched builds.
- Monitor kernel ring buffer output (dmesg) for crash signatures coinciding with module unload or device hot-removal events.
Monitoring Recommendations
- Centralize kernel logs from Linux hosts using ATSHA204A devices and alert on oops or KASAN reports referencing crypto or hwrng subsystems.
- Track package and kernel inventory across the fleet to confirm patched kernels are deployed on every affected stable branch.
- Audit which workloads bind to /dev/hwrng so that the operational impact of driver reloads can be assessed before changes.
How to Mitigate CVE-2026-46075
Immediate Actions Required
- Apply the upstream Linux kernel patches that unregister the hwrng, flush the Atmel I2C workqueue, and remove the early return in the atmel-sha204a remove path.
- Update to a distribution kernel that incorporates the fix on the stable branch in use.
- Avoid unbinding or unloading the atmel-sha204a driver on production systems running unpatched kernels.
Patch Information
Upstream commits resolving CVE-2026-46075 are available in the stable tree: Kernel Git Commit 1193c12126, Kernel Git Commit 31901371cc, Kernel Git Commit 775c00d87c, Kernel Git Commit bab1adf3b8, and Kernel Git Commit c5a45d1423. Rebuild and reboot affected kernels to activate the fix.
Workarounds
- Where patching is not yet possible, do not unload or unbind the atmel-sha204a driver while the system is operational.
- Restrict access to /dev/hwrng to trusted processes to reduce the chance of concurrent reads during driver teardown.
- Disable the driver entirely on systems that do not require the ATSHA204A as a randomness source until the patched kernel is deployed.
# Verify whether the running kernel still loads atmel-sha204a
lsmod | grep atmel_sha204a
# Blacklist the driver on unpatched hosts that do not need it
echo 'blacklist atmel_sha204a' | sudo tee /etc/modprobe.d/atmel-sha204a.conf
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
