The Atmel SHA‑204a driver in the Linux kernel contains a flaw that occurs during its removal procedure. When the driver is torn down while its hardware random number generator callbacks are still queued, the driver fails to unregister the callback and to drain its internal I2C workqueue. A queued callback can therefore execute against freed driver data, resulting in a use‑after‑free that could allow an attacker to run code with kernel privileges. Additionally, an early return prevents the driver’s sysfs entries and the hwrng private data from being freed, leading to a memory leak that may degrade system stability over time.

Any Linux kernel build that still contains the unpatched atmel‑sha204a module. The vendor list identifies the Linux kernel; no specific version range is supplied, meaning that all kernels prior to the commit that applied the fix are potentially vulnerable if the module is present.

Use‑after‑free vulnerabilities in kernel drivers can enable high‑privilege code execution, but the description does not confirm exploitable control over the callback data. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, so the likelihood of exploitation cannot be quantified. The risk is theoretical and would depend on an attacker’s ability to trigger the module’s removal while callbacks remain queued, making practical exploitation uncertain given typical host protection mechanisms.