CVE-2026-80835: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-80835 Overview

CVE-2026-80835 is a race condition vulnerability in the Linux kernel's qcom-rng driver. The driver exposes a single Qualcomm hardware random number generator (RNG) through two independent interfaces: crypto_rng and hwrng. Generation operations on these interfaces run concurrently and access the same hardware registers without synchronization. Specifically, qcom_rng_generate() synchronizes with itself but not with qcom_hwrng_read(). The result is potential repetition of RNG output and generation of non-random values, weakening any cryptographic operation that consumes those bytes. The upstream fix removes the redundant crypto_rng interface, leaving only hwrng.

Critical Impact
Concurrent access to shared RNG registers can produce repeated or non-random output, undermining the entropy assumptions of downstream cryptographic consumers.

Affected Products

Linux kernel builds including the qcom-rng driver (drivers/char/hw_random/qcom-rng.c)
Qualcomm platforms relying on the Qualcomm hardware RNG through both crypto_rng and hwrng interfaces
Distributions shipping kernels prior to the referenced stable commits

Discovery Timeline

2026-09-04 - CVE-2026-80835 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80835

Vulnerability Analysis

The qcom-rng driver registers the same Qualcomm hardware RNG with two kernel subsystems. The crypto_rng path invokes qcom_rng_generate(), while the hwrng path invokes qcom_hwrng_read(). Both functions read from the same memory-mapped device registers to pull randomness from the hardware. The locking in qcom_rng_generate() serializes callers within the crypto_rng interface but does not coordinate with qcom_hwrng_read(). Two threads entering the driver through different interfaces can therefore issue interleaved register reads. Interleaving corrupts the hardware read sequence, causing the driver to return repeated output or values that no longer satisfy randomness properties.

Root Cause

The root cause is a race condition [CWE-362] created by exposing one shared hardware resource through two synchronization domains. Each interface holds its own lock, but neither is aware of the other. Any consumer of /dev/hwrng, kernel entropy pools seeded via hwrng, or AF_ALG "rng" clients using crypto_rng can collide with a concurrent user on the other path.

Attack Vector

The vulnerability requires local access to the affected kernel interfaces. It is not remotely exploitable and does not grant privilege escalation on its own. The concern is cryptographic: any workload that consumes the affected RNG output for key material, nonces, or IVs may receive predictable or repeated bytes. The upstream resolution removes the crypto_rng registration entirely, eliminating the conflicting interface. The maintainers note that the crypto_rng type is used almost exclusively by the AF_ALG "rng" algorithm and is being phased out across hardware RNG drivers. Technical detail is documented in the Linux Kernel Commit bb474dc and the corresponding stable backports.

Detection Methods for CVE-2026-80835

Indicators of Compromise

Repeated byte sequences returned from /dev/hwrng on affected Qualcomm platforms
Duplicate or low-entropy output surfaced by AF_ALG "rng" consumers running concurrently with hwrng readers
Kernel version strings matching pre-patch qcom-rng builds on Qualcomm hardware

Detection Strategies

Inventory kernel build metadata to identify hosts running qcom-rng without the referenced stable commits
Perform statistical randomness tests on RNG output collected under concurrent load through both interfaces
Audit userspace consumers that open both AF_ALG "rng" sockets and /dev/hwrng on the same device

Monitoring Recommendations

Track kernel package versions across the fleet and alert when Qualcomm-based devices drift from patched baselines
Log processes accessing /dev/hwrng and AF_ALG sockets to correlate suspicious concurrent usage
Monitor entropy-consuming services (TLS terminators, VPN daemons, key generation tools) for anomalies on affected hardware

How to Mitigate CVE-2026-80835

Immediate Actions Required

Apply the upstream fix that removes the crypto_rng interface from qcom-rng.c
Update to a kernel version incorporating the referenced stable commits on all affected Qualcomm devices
Restrict local access to /dev/hwrng and AF_ALG sockets to trusted service accounts

Patch Information

The fix removes the crypto_rng registration from the qcom-rng driver, leaving the hwrng interface as the sole path to the hardware. Stable backports are available in the following commits: Linux Kernel Commit bb474dc, Linux Kernel Commit 843e2bd, Linux Kernel Commit 669d940, Linux Kernel Commit 2ecdf5c, and Linux Kernel Commit 14d9ee8.

Workarounds

Disable the AF_ALG "rng" algorithm type where feasible to prevent concurrent access through crypto_rng
Serialize userspace consumers so that only one interface reads the Qualcomm RNG at a time
Prefer kernel-managed entropy pools (/dev/urandom, getrandom(2)) over direct RNG interface reads until patched

bash

# Verify running kernel and qcom-rng module state
uname -r
modinfo qcom_rng 2>/dev/null | grep -E 'filename|version'
# Restrict device node access to trusted groups
chgrp entropy /dev/hwrng && chmod 0640 /dev/hwrng