Entropy Device Random Number Generator Vulnerability in Zephyr Project

CVE-2026-87043

What is CVE-2026-87043?

The entropy-device random number generator in the Zephyr RTOS can prematurely return uninitialized data when the device is not ready, leading to potential exposure of stale memory or constant values as random data. This issue arises when the system's entropy drivers fail to initialize correctly, leaving critical non-cryptographic random outputs vulnerable to exploitation. The vulnerability poses risks to various protocols, affecting CoAP tokens, TCP initial sequence numbers, and DHCP transaction IDs, among others. An attacker can remotely observe and exploit these non-random values, raising significant data integrity concerns.

References