CVE-2026-87043

The entropy-device random number generator in subsys/random/random entropy device.c returned early with -ENODEV from rand get() as soon as device is ready() failed, before reaching the non-cryptographic system-timer fallback further down the same function. Because z impl sys rand get() returns void and discards that error — and the public sys rand get() syscall is itself declared void, so it cannot report failure — the caller's output buffer was left untouched and its previous contents were handed back as random data. The thin wrappers make this a plain uninitialized read: sys rand32 get() declares uint32 t ret;, calls sys rand get(&ret, sizeof(ret)) and returns ret.

The "not ready" state is a normal runtime condition rather than a fault. Entropy drivers initialise at PRE KERNEL 1 with CONFIG ENTROPY INIT PRIORITY (default 50), so any earlier initialiser — kernel objects run at priority 30 — observes an unready device; the sibling generator subsys/random/random xoshiro128.c and z early rand get() in kernel/init.c both already carried an explicit timer fallback for exactly this case. The state is also permanent for the boot when an entropy driver's init hook fails, which several in-tree drivers can do on real hardware (entropy stm32 on an RNG clock configuration error, entropy psa crypto when psa crypto init() fails, entropy nrf cracen, entropy esp32, entropy virtio).

When this occurs, every non-cryptographic random value in the system is either a constant or stale memory. coap next token() in subsys/net/lib/coap/coap.c fills a static buffer, so every CoAP token becomes the same .bss constant; tcp init isn() in subsys/net/ip/tcp.c returns an uninitialized stack word as the TCP initial sequence number; DHCPv4/DHCPv6 transaction IDs, WebSocket masking keys and RTP SSRCs are similarly degraded, and arch/arm64/core/pac.c derives per-thread Pointer Authentication keys from the same source. Where the bytes are transmitted directly — SSH packet padding, the netmidi2 session nonce, a DTLS connection ID on builds without CONFIG CSPRNG ENABLED — stale caller stack or heap contents are disclosed on the wire.

The fix initialises ret to -ENODEV and only calls entropy get entropy() when the device is ready, so the not-ready case now falls through to the timer fallback and the buffer is always written. The cryptographically secure path is unchanged: sys csrand get() still propagates the error to the caller and never silently degrades. An attacker cannot induce the unready state, but can observe and exploit the resulting non-random values remotely on an affected device.