CVE-2026-74402
Description
A flaw was found in the Linux kernel's atmel-sha204a cryptographic hardware random number generator (HWRNG) driver. Improper buffer management in both blocking and non-blocking paths causes the driver to fail in providing valid entropy. This occurs because the buffer is read starting from byte 1, and only a partial amount of random data is fetched from the return message. Consequently, cryptographic operations relying on this hardware random number generator may be weakened due to insufficient randomness.
Statement
A moderate-impact flaw was found in the Linux kernel's atmel-sha204a cryptographic hardware random number generator (HWRNG) driver. Improper buffer management in both the blocking and non-blocking read paths caused the driver to fail to provide valid entropy: the response buffer was read starting at byte 1 instead of byte 0, and only part of the 32 bytes of random data in the device's return message was fetched. On systems equipped with an Atmel SHA204A HWRNG device, reads from /dev/hwrng could therefore return reduced or predictable data, weakening cryptographic operations that depend on this hardware random number generator. The issue is limited to kernels containing the atmel-sha204a driver used with the corresponding Atmel hardware. Red Hat Enterprise Linux and Red Hat In-Vehicle OS are not affected by this flaw because the vulnerable code is not present in the shipped kernel packages for the listed streams.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
