---
id: CVE-2026-93163
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  hwrng: core - fix rng list on registration error

  hwrng_register(rng) does the following:

  1
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  hwrng: core - fix rng list on registration error

  hwrng_register(rng) does the following:

  1. Checks if rng has name and read methods set
  2. Checks if the name already …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 2bbb6983887fefc8026beab01198d30f47b7bd22 <
    de4f1bcb61a73cc896decdbd27d61a34add93b53
  - >-
    Linux >= 2bbb6983887fefc8026beab01198d30f47b7bd22 <
    cf293c9c7424de0d04b51367d07f40570ce80231
  - >-
    Linux >= 2bbb6983887fefc8026beab01198d30f47b7bd22 <
    bee8d1fcdc8f389b595b0a4cf6fe8440f499458a
  - >-
    Linux >= 2bbb6983887fefc8026beab01198d30f47b7bd22 <
    3a5834db2b1ce25649f330e78efe1ccde78967fd
  - Linux 42802952a2725f85f7e36ee3b29593af5fe87197
  - Linux >= 4.9.320 < 4.10
  - Linux 4.14
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:18:11.763'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93163'
references:
  - url: 'https://git.kernel.org/stable/c/3a5834db2b1ce25649f330e78efe1ccde78967fd'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/bee8d1fcdc8f389b595b0a4cf6fe8440f499458a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cf293c9c7424de0d04b51367d07f40570ce80231'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/de4f1bcb61a73cc896decdbd27d61a34add93b53'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.733Z'
epss: 0.00209
epssPercentile: 0.09827
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

hwrng: core - fix rng list on registration error

hwrng_register(rng) does the following:

1. Checks if rng has name and read methods set
2. Checks if the name already exists
3. Adds rng to global rng_list
4. May try to set rng to current_rng

If step 4 fails, it returns an error. However, it does not remove the
rng from rng_list, causing a dangling reference which can result in
use-after-free if the caller frees rng, since registration failed.

Add a list_del_init() cleanup step.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.