CVE-2025-40127

The vulnerability is a division by zero in the ks-sa hardware random number generator driver's initialization function. The root cause is that clk_get_rate() is invoked on an uninitialized clock pointer, leading to a division by zero when computing delay values. This bug was introduced in a prior commit and remains exploitable until the driver is loaded.

Exploitation requires the ability to initialize the ks-sa hwrng device, which typically occurs during system boot or when the kernel module is loaded. No special privileges beyond local access are needed. The attack surface is limited to systems that incorporate the KeyStone SA hardware RNG.

The impact is a kernel panic (denial of service) triggered by the division by zero. An attacker who can force the driver to initialize can cause the system to crash, making the system unavailable.

The fix has been applied in multiple kernel stable commits. Users are advised to update their kernels to include the fix. No workaround is available other than avoiding use of the vulnerable driver.