CVE-2026-80835
Received Received - Intake

crypto_rng Interface Removal in Linux Kernel

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - Remove crypto_rng interface qcom-rng.c exposes the same hardware through two completely separate interfaces, crypto_rng and hwrng. However, the implementation of this is buggy because it permits generation operations from these interfaces to run concurrently with each other, accessing the same registers. That is, qcom_rng_generate() synchronizes with itself but not with qcom_hwrng_read(). This results in potential repetition of output from the RNG, output of non-random values, etc. Fortunately, there's actually no point in hardware RNG drivers implementing the crypto_rng interface. It's not actually used by anything besides the "rng" algorithm type of AF_ALG, which in turn is not actually used in practice. Other crypto_rng hardware drivers are likewise being phased out, leaving just the hwrng support. Thus, remove it to simplify the code and avoid conflict (and confusion) with the hwrng interface which is the one that actually matters.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80835
EUVD
EUVD-2026-71285

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel to 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a bug in the qcom-rng driver where two separate interfaces, crypto_rng and hwrng, access the same hardware registers concurrently. This can lead to repeated output, non-random values, or other unpredictable behavior from the Random Number Generator (RNG).

Detection Guidance

This vulnerability is specific to the Linux kernel's qcom-rng driver and does not have a direct network detection method. To check if your system is affected, verify if the qcom-rng driver is loaded and if the crypto_rng interface is exposed. Run: lsmod | grep qcom_rng and check kernel logs for related errors.

Impact Analysis

The vulnerability could result in weak or predictable random numbers being generated, which may affect security-sensitive operations like encryption keys, session tokens, or cryptographic protocols. However, the impact is limited since the crypto_rng interface is rarely used in practice.

Mitigation Strategies

Update your Linux kernel to the latest stable version where this vulnerability is patched. Remove or disable the qcom-rng driver if not needed. Monitor kernel logs for unusual RNG output patterns or errors related to concurrent access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80835. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart