Executive brief
A vulnerability was identified in the Linux kernel's Trusted Platform Module (TPM) 2.0 session management. The TPM is a specialized chip used to secure hardware through cryptographic keys and platform integrity measurements. An attacker with local access could exploit this flaw to cause memory corruption, potentially leading to a system crash or unauthorized access to sensitive information secured by the TPM.
Technical details
An out-of-bounds indexing vulnerability exists in the 'name_size' function within 'drivers/char/tpm/tpm2-sessions.c'. The function directly indexes a static array using 'TPM_ALG_ID' values without performing range validation. This can lead to memory corruption when processing malformed or unrecognized algorithm IDs. The fix introduces explicit switch-case validation for supported hash algorithms (SHA1, SHA256, SHA384, SHA512) and returns -EINVAL for unknown values. Additionally, 'tpm_buf_append_name' and 'tpm_buf_fill_hmac_session' were updated to be fallible to prevent spurious TPM traffic and session state corruption.
Affected products
- Linux Linux Kernel 6.10 to 6.12.65, 6.13 to 6.18.2
Timeline
- 2025-11-30: disclosed: Initial patch authored by Jarkko Sakkinen
- 2026-01-02: patched: Patch committed to stable tree
- 2026-01-13: advisory: CVE published