CVE-2026-74402

Received Received - Intake

Improper Entropy Generation in Linux Kernel Atmel SHA204A Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a - fix blocking and non-blocking rng logic The blocking and non-blocking paths were failing to provide valid entropy due to improper buffer management. Reading the buffer starting from byte 1, only fetch the 32 bytes of random data from the return message. Tested on an Atmel SHA204A device. Before (here for blocking), tests showed repeatedly reading reduced bytes. $ head -c 32 /dev/hwrng | hexdump -C 00000000 02 28 85 b3 47 40 f2 ee 00 00 00 00 00 00 00 00 |.(..G@..........| 00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 00000020 After, the result will be similar to the following: $ head -c 32 /dev/hwrng | hexdump -C 00000000 5a fc 3f 13 14 68 fe 06 68 0a bd 04 83 6e 09 69 |Z.?..h..h....n.i| 00000010 75 ff cf 87 10 84 3b c9 c1 df ae eb 45 53 4c c3 |u.....;.....ESL.| 00000020

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74402

EUVD

EUVD-2026-59549

Affected Vendors & Products

Vendor	Product	Version / Range
atmel	sha204a	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel affects the Atmel SHA204A cryptographic device. The issue is in the random number generator (RNG) logic where both blocking and non-blocking paths fail to provide valid entropy due to incorrect buffer management. Specifically, the buffer was read starting from byte 1 instead of byte 0, causing only 32 bytes of random data to be fetched from a 32-byte return message.

Detection Guidance

To detect this vulnerability, check the entropy output from the Atmel SHA204A device using the hardware random number generator. Run the command 'head -c 32 /dev/hwrng | hexdump -C' and verify if the output contains valid random data or if it shows repeated zeros or invalid bytes.

Impact Analysis

This vulnerability could lead to weak or predictable random numbers being generated by systems using the affected Atmel SHA204A device. Weak entropy can compromise cryptographic operations like encryption keys, authentication tokens, or secure communications, potentially leading to security breaches or data leaks.

Compliance Impact

This vulnerability affects the generation of random data used for cryptographic purposes, which could impact compliance with standards requiring secure random number generation such as GDPR (data encryption) and HIPAA (secure data handling). Weak or predictable entropy may lead to vulnerabilities in encryption, potentially violating data protection requirements.

Mitigation Strategies

Apply the Linux kernel patch that fixes the blocking and non-blocking random number generator logic for the Atmel SHA204A device. Update your kernel to a version that includes this fix to ensure proper entropy generation.

Hi! I’m here to help you understand CVE-2026-74402. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70