Linux Kernel CVE-2026-45949

Exploitation requires local access with at least low-level privileges sufficient to trigger hardware RNG device registration and unregistration events - in practice, this means a guest VM operator or privileged process with the ability to hot-plug or hot-unplug a virtio-rng device, or to load and unload the relevant kernel module. The race window is specifically between concurrent invocations of hwrng_register() and hwrng_unregister() in the hwrng core; the vulnerability is not reachable from a pure userspace context without triggering these kernel paths. Exploitation is significantly limited by: (1) High Attack Complexity - the TOCTOU race requires precise timing to exploit reliably; (2) local-only access - the vulnerability has no network-facing component; (3) impact is restricted to availability (kernel crash and reboot) with no confirmed confidentiality or integrity consequence. Systems that never hot-plug hardware or virtual RNG devices and do not dynamically load/unload the hw_random module are not exposed to this race path.

The CVSS 3.1 score of 4.7 (Medium) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H accurately reflects constrained real-world risk. The High Attack Complexity metric directly reflects the timing-sensitive race window required to trigger the use-after-free, and local access with at least low-level privileges is required - this vulnerability is not remotely exploitable in any standard configuration. The EPSS score of 0.02% (5th percentile) confirms negligible opportunistic exploitation, and no CISA KEV listing has been found. A notable data quality issue: the intelligence tags include 'Information Disclosure,' which directly conflicts with the CVSS vector (C:N) and the described impact, which is strictly availability (kernel crash via use-after-free). This tag is assessed as erroneous - no confidentiality impact has been confirmed by any source. The primary real-world risk is targeted DoS against virtualized workloads, particularly during VM lifecycle events (guest addition/removal of virtio-rng devices), where the virtrng_remove path is reliably triggered. For static bare-metal systems that never hot-plug RNG devices, the practical risk is negligible.

A low-privileged operator on a virtualized Linux host running a vulnerable kernel (e.g., 6.18.x prior to 6.18.14) rapidly attaches and detaches a virtio-rng device, triggering concurrent hwrng_register() and hwrng_unregister() calls in the guest kernel. The race condition causes hwrng_fill to be read outside the rng_mutex lock, resulting in kthread_stop() being invoked on a freed task_struct, producing a kernel use-after-free crash and guest system reboot. No public proof-of-concept exploit has been identified; reliably winning the race window requires precise timing, consistent with the CVSS High Complexity rating.