CVE-2026-46075

Analyzed Analyzed - Analysis Complete

Use-After-Free and Memory Leak in Linux Kernel's atmel-sha204a Crypto Driver

Publication date: 2026-05-27

Last updated on: 2026-06-24

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path Unregister the hwrng to prevent new ->read() calls and flush the Atmel I2C workqueue before teardown to prevent a potential UAF if a queued callback runs while the device is being removed. Drop the early return to ensure sysfs entries are removed and ->hwrng.priv is freed, preventing a memory leak.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-27

Last Modified

2026-06-24

Generated

2026-07-07

AI Q&A

2026-05-27

EPSS Evaluated

2026-07-05

NVD

CVE-2026-46075

EUVD

EUVD-2026-32457

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.7 (inc) to 6.12.86 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.140 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.27 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.4 (exc)
linux	linux_kernel	From 5.3 (inc) to 6.1.175 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's crypto subsystem, specifically in the atmel-sha204a driver. It involves a potential use-after-free (UAF) and memory leak during the device removal process. The issue arises because the hardware random number generator (hwrng) was not properly unregistered, allowing new read calls to occur while the device was being removed. Additionally, the Atmel I2C workqueue was not flushed before teardown, which could lead to a queued callback running on a freed device, causing a UAF. There was also an early return that prevented sysfs entries from being removed and the hwrng private data from being freed, resulting in a memory leak.

Impact Analysis

This vulnerability can lead to use-after-free conditions and memory leaks in the Linux kernel, which may cause system instability or crashes. Exploiting the use-after-free could potentially allow an attacker to execute arbitrary code or cause denial of service by triggering kernel faults. Memory leaks could degrade system performance over time.

Mitigation Strategies

The vulnerability has been resolved by updating the Linux kernel to include fixes in the atmel-sha204a crypto driver. Immediate mitigation involves applying the updated Linux kernel version that contains the fix.

Specifically, the fix unregisters the hardware random number generator (hwrng) to prevent new read calls, flushes the Atmel I2C workqueue before device teardown to prevent use-after-free (UAF), and ensures sysfs entries are removed and memory is freed to prevent leaks.

Hi! I’m here to help you understand CVE-2026-46075. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70