The Linux kernel driver for the Xilinx TRNG contains two core weaknesses: a function that may report success even when it fails to populate all output bytes, and a broken locking mechanism that allows concurrent generate and read operations to interfere with each other. These faults can corrupt the internal state of the driver, leading to incomplete or stale random data being supplied to the system. When used as a source for cryptographic operations, the weakness undermines the confidentiality, integrity, and availability properties of those operations.

All Linux kernel builds that include the xilinx-trng driver are affected. The flaw is present in kernel releases prior to the patch that removes the obsolete crypto_rng interface. Systems that rely on Xilinx hardware for entropy generation, or custom kernels that compile this driver, must verify whether they contain the driver and apply the latest stable Linux kernel update that implements the removal of the interface.

The risk is moderate. The flaw appears to be locally exploitable, as the description indicates that race conditions between the generate and read paths could be triggered by a local attacker or code with elevated privileges. This inference is based on the fact that the driver operates in kernel space and the locking bug can be exercised by local processes. No EPSS score is available and the vulnerability is not listed in the KEV catalog, suggesting limited evidence of widespread exploitation. Because the weakness affects random number generation, a local adversary could potentially destabilize cryptographic operations or cause denial of service by exhausting entropy. Administrators should treat this as a moderate severity issue that requires timely kernel update.