Executive brief
A memory leak vulnerability was identified in the Linux kernel's Trusted Platform Module (TPM) 2.0 session management. The TPM is a hardware component used for secure cryptographic operations and system integrity. This flaw could allow the system to slowly run out of memory during certain TPM operations, potentially leading to system instability or a denial of service over time.
Technical details
A memory leak exists in the tpm2_read_public() function within drivers/char/tpm/tpm2-sessions.c. The function initializes a buffer using tpm_buf_init() but fails to release the associated page allocation via tpm_buf_destroy() on two specific exit paths: when name_size() returns an error due to an unrecognized hash algorithm, and upon successful completion of the function. This results in a leaked page allocation for each occurrence. An attacker with local access could potentially trigger these paths repeatedly to exhaust system memory. The issue has been resolved in the stable kernel branches by adding the missing tpm_buf_destroy() calls.
Affected products
- Linux Linux Kernel v6.19+
Timeline
- 2026-04-15: other: Patch authored
- 2026-05-27: disclosed: CVE published