CVE-2026-93159 crypto: atmel-sha204a - fix heap info leak on I2C transfer failure
A local attacker can read uninitialized kernel memory via the atmel-sha204a crypto driver when I2C transfers fail, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93159?
CVE-2026-93159 is a vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
crypto: atmel-sha204a - fix heap info leak on I2C transfer failure
The nonblocking RNG path allocates a work_data structure to track the state of an in-flight asynchronous I2C request. This pointer is stored in rng->priv and later consumed by the read path once the transaction completes.
If the underlying I2C transfer fails, the completion callback is invoked with a non-zero status. In this case, the allocated work_data is not usable for producing RNG output and must not remain associated with the hwrng state.
Previously, the failure path only logged a warning but left the pointer state uncleared, which can result in subsequent read attempts observing stale state and interpreting it as valid completion data.
Fix this by freeing the pending work_data. The I2C transaction reports an error. This ensures that failed requests do not leave residual state behind that could be interpreted as valid RNG data on later reads. Clearing rng->priv is done at the subsequent call to nonblocking read.
Which versions are affected by CVE-2026-93159?
How do I fix CVE-2026-93159?
Apply the vendor's patch.
Is CVE-2026-93159 being exploited?
There is no known exploitation of CVE-2026-93159 in the wild and no public exploit code.
Sources
Also known as AZL-102479, BELL-CVE-2026-93159, DEBIAN-CVE-2026-93159, GHSA-4wj4-h74m-5rjv, UBUNTU-CVE-2026-93159.