From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7B1EA542ECC for ; Thu, 17 Sep 2026 16:41:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789663306; cv=none; b=Rb8GkvODnlZpHjqf9zPPpkkSUR5ntWqjVL8i5411zr97unyL1DiwJDml5ze+VLdlA+uMvIWDil5mfJO63AZZW4nWsE1FKE69IpiM/0/4AHiouK87UPHsWEIXw/m7bxrkPsvHoihNsdGU/Qp/Fq4w/ZW5B37diOWthH1D0MA/xFc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789663306; c=relaxed/simple; bh=m9llpYHBGLIgWLGJ4DbcPSrgO7n324iyOW56+f/yVCk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=HsSA6b8/Q+0HVJtsJ/1OpO1UEjA/OZgQ0E6JtMqfuQE7VmSsqvrmUiqFv6BzKiF+xp7NPHmfP1OT1kK5gGYjv6lZBxs44E54irXKAa38WsZ/h2dswVoXhpBmkJNxyAjIj+t3QZQMC9S6XsXQTTw385+VcLMO12ko0dO0YNCcDso= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=cDl66I34; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="cDl66I34" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D0DD61F000FF; Thu, 17 Sep 2026 16:41:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789663303; bh=hCo6ga+TuuC7CmDsAg+WwFYyuhnj3hoRfLLg/vV0Yfw=; h=From:To:Cc:Subject:Date:Reply-To; b=cDl66I34Gn1jAX63rfcb9gGYPCllOW3KFrtuIfr94i5llPHhCYEGSQWQB6QvHsGLI g+W5Z5tB+u+wTGrlv+SP8BKbGyVRyWfuzBG/IihRv8ON1JQavbEyD+cuLJzk2OSE6K QvI1ot5ZbHKRBAXc6PgXzn6wKXl2F1et5jfwcUvc= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-93159: crypto: atmel-sha204a - fix heap info leak on I2C transfer failure Date: Thu, 17 Sep 2026 17:17:16 +0100 Message-ID: <2026091757-CVE-2026-93159-617c@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4102; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=PHf0lmyul0ZIZZgZYiDcZB1WTRou0gaV0pj7NEV/3Vk=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlrBK6+/81f+ffRvpUPuufbpbTdFrZlvnJs4e95d841X BFgP7RjUUcsC4MgE4OsmCLLl208R/dXHFL0MrQ9DTOHlQlkCAMXpwBM5MU9hgUr76wUebCwoWNO /bstfE2M1lL3X0gwLJj59o5Q6BPBCZrfl8afuN67XiDqXwUA X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a - fix heap info leak on I2C transfer failure The nonblocking RNG path allocates a work_data structure to track the state of an in-flight asynchronous I2C request. This pointer is stored in rng->priv and later consumed by the read path once the transaction completes. If the underlying I2C transfer fails, the completion callback is invoked with a non-zero status. In this case, the allocated work_data is not usable for producing RNG output and must not remain associated with the hwrng state. Previously, the failure path only logged a warning but left the pointer state uncleared, which can result in subsequent read attempts observing stale state and interpreting it as valid completion data. Fix this by freeing the pending work_data. The I2C transaction reports an error. This ensures that failed requests do not leave residual state behind that could be interpreted as valid RNG data on later reads. Clearing rng->priv is done at the subsequent call to nonblocking read. The Linux kernel CVE team has assigned CVE-2026-93159 to this issue. Affected and fixed versions =========================== Issue introduced in 5.3 with commit da001fb651b00e1deeaf24767dd691ae8152a4f5 and fixed in 5.10.270 with commit a430b5b6d2ddd2b266330f8507a655be1148347d Issue introduced in 5.3 with commit da001fb651b00e1deeaf24767dd691ae8152a4f5 and fixed in 5.15.221 with commit 4e76d85e505b7451925efbcd67c015e8c2440c68 Issue introduced in 5.3 with commit da001fb651b00e1deeaf24767dd691ae8152a4f5 and fixed in 6.1.188 with commit bcac9052e19490231ff6e0678a06bd2fcf8db3af Issue introduced in 5.3 with commit da001fb651b00e1deeaf24767dd691ae8152a4f5 and fixed in 6.6.157 with commit 28cc179252347718f97045dd5ea74165609dbd7d Issue introduced in 5.3 with commit da001fb651b00e1deeaf24767dd691ae8152a4f5 and fixed in 6.12.110 with commit 0d6db386133d9230befb77967bbf130443964860 Issue introduced in 5.3 with commit da001fb651b00e1deeaf24767dd691ae8152a4f5 and fixed in 6.18.52 with commit f4d347fb1309b69ea6f817a17e6b2893c8d754b7 Issue introduced in 5.3 with commit da001fb651b00e1deeaf24767dd691ae8152a4f5 and fixed in 7.2.6 with commit 94abda77b57a35b82bba0365bad072d94d67ffe9 Issue introduced in 5.3 with commit da001fb651b00e1deeaf24767dd691ae8152a4f5 and fixed in 7.3-rc1 with commit 72bbf11ba14bd7d5fbf31a1ec42fff608b657f74 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-93159 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/crypto/atmel-sha204a.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/a430b5b6d2ddd2b266330f8507a655be1148347d https://git.kernel.org/stable/c/4e76d85e505b7451925efbcd67c015e8c2440c68 https://git.kernel.org/stable/c/bcac9052e19490231ff6e0678a06bd2fcf8db3af https://git.kernel.org/stable/c/28cc179252347718f97045dd5ea74165609dbd7d https://git.kernel.org/stable/c/0d6db386133d9230befb77967bbf130443964860 https://git.kernel.org/stable/c/f4d347fb1309b69ea6f817a17e6b2893c8d754b7 https://git.kernel.org/stable/c/94abda77b57a35b82bba0365bad072d94d67ffe9 https://git.kernel.org/stable/c/72bbf11ba14bd7d5fbf31a1ec42fff608b657f74