CVE-2026-80871
Received Received - Intake

Linux Kernel Crypto RNG Interface Removal

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: crypto: xilinx-trng - Remove crypto_rng interface Implementing the crypto_rng interface has no purpose, as it isn't used in practice. It's being removed from other drivers too. Just remove it. This leaves hwrng, which is actually used. Tagging with 'Cc stable' due to the bugs that this removes: - xtrng_trng_generate() sometimes returned success even when it didn't fill in all the bytes. - It was possible for xtrng_trng_generate() and xtrng_hwrng_trng_read() to run concurrently and interfere with each other, as the locking code in xtrng_hwrng_trng_read() was broken.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80871
EUVD
EUVD-2026-71501

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the removal of the crypto_rng interface from the Xilinx True Random Number Generator (TRNG) driver in the Linux kernel. The interface was unused in practice and its removal fixes two bugs: one where the function could incorrectly report success without filling all requested bytes, and another where concurrent access could cause interference due to broken locking in the hwrng read function.

Detection Guidance

This vulnerability is specific to the Linux kernel's crypto subsystem, particularly the xilinx-trng driver. Detection involves checking if the affected driver is present and if the crypto_rng interface is still being used. Commands like 'lsmod | grep xilinx_trng' can verify if the driver is loaded. Inspect kernel logs for errors related to xtrng_trng_generate or xtrng_hwrng_trng_read.

Impact Analysis

If you use a system with the affected Linux kernel and Xilinx TRNG driver, this vulnerability could lead to incorrect random number generation, potentially causing security issues in cryptographic operations. The concurrent access bug might also cause system instability or crashes.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. The issue involves a Linux kernel driver (xilinx-trng) where the crypto_rng interface was removed due to lack of use and potential bugs. The changes improve reliability but do not introduce data exposure or processing risks that would impact regulatory compliance.

Mitigation Strategies

Update the Linux kernel to a version that includes the fix for CVE-2026-80871. Remove or disable the xilinx-trng driver if it is not required. Ensure no applications rely on the removed crypto_rng interface to avoid functionality issues.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80871. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart