---
id: CVE-2026-93159
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  crypto: atmel-sha204a - fix heap info leak on I2C transfer failure

  The nonblocking RNG path allocates a work_data structure to track the
  state of an in-flight asynchro…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  crypto: atmel-sha204a - fix heap info leak on I2C transfer failure

  The nonblocking RNG path allocates a work_data structure to track the
  state of an in-flight asynchro…
severity: medium
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= da001fb651b00e1deeaf24767dd691ae8152a4f5 <
    a430b5b6d2ddd2b266330f8507a655be1148347d
  - >-
    Linux >= da001fb651b00e1deeaf24767dd691ae8152a4f5 <
    4e76d85e505b7451925efbcd67c015e8c2440c68
  - >-
    Linux >= da001fb651b00e1deeaf24767dd691ae8152a4f5 <
    bcac9052e19490231ff6e0678a06bd2fcf8db3af
  - >-
    Linux >= da001fb651b00e1deeaf24767dd691ae8152a4f5 <
    28cc179252347718f97045dd5ea74165609dbd7d
  - >-
    Linux >= da001fb651b00e1deeaf24767dd691ae8152a4f5 <
    0d6db386133d9230befb77967bbf130443964860
  - >-
    Linux >= da001fb651b00e1deeaf24767dd691ae8152a4f5 <
    f4d347fb1309b69ea6f817a17e6b2893c8d754b7
  - >-
    Linux >= da001fb651b00e1deeaf24767dd691ae8152a4f5 <
    94abda77b57a35b82bba0365bad072d94d67ffe9
  - >-
    Linux >= da001fb651b00e1deeaf24767dd691ae8152a4f5 <
    72bbf11ba14bd7d5fbf31a1ec42fff608b657f74
  - Linux 5.3
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:18:11.277'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93159'
references:
  - url: 'https://git.kernel.org/stable/c/0d6db386133d9230befb77967bbf130443964860'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/28cc179252347718f97045dd5ea74165609dbd7d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4e76d85e505b7451925efbcd67c015e8c2440c68'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/72bbf11ba14bd7d5fbf31a1ec42fff608b657f74'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/94abda77b57a35b82bba0365bad072d94d67ffe9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a430b5b6d2ddd2b266330f8507a655be1148347d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/bcac9052e19490231ff6e0678a06bd2fcf8db3af'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f4d347fb1309b69ea6f817a17e6b2893c8d754b7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93159.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-93159'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2536807'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-93159'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93159'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93159.mbox
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ingestedAt: '2026-09-17T16:21:47.734Z'
epss: 0.0022
epssPercentile: 0.1107
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-459
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

crypto: atmel-sha204a - fix heap info leak on I2C transfer failure

The nonblocking RNG path allocates a work_data structure to track the
state of an in-flight asynchronous I2C request. This pointer is stored
in rng->priv and later consumed by the read path once the transaction
completes.

If the underlying I2C transfer fails, the completion callback is invoked
with a non-zero status. In this case, the allocated work_data is not
usable for producing RNG output and must not remain associated with the
hwrng state.

Previously, the failure path only logged a warning but left the pointer
state uncleared, which can result in subsequent read attempts observing
stale state and interpreting it as valid completion data.

Fix this by freeing the pending work_data. The I2C transaction reports
an error. This ensures that failed requests do not leave residual state
behind that could be interpreted as valid RNG data on later reads.
Clearing rng->priv is done at the subsequent call to nonblocking read.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93159.json)