Executive brief
A security issue was identified in the Linux kernel's Trusted Platform Module (TPM) driver where sensitive cryptographic data was not properly cleared from memory. The TPM is a specialized chip used to secure hardware through integrated cryptographic keys. If an attacker gains local access to the system, they might be able to recover sensitive information like session keys or passphrases from the system's memory after the device is closed.
Technical details
A vulnerability in the Linux kernel's TPM driver (specifically in `tpm_dev_release`) resulted from using `kfree()` instead of `kfree_sensitive()` to release the `chip->auth` structure. This structure contains sensitive data including HMAC session keys, nonces, and passphrase data (struct `tpm2_auth`). By failing to zero this memory before freeing it, the cryptographic material remained in the slab allocator's freed memory until overwritten by subsequent allocations. An attacker with local access to system memory could potentially recover these secrets. The issue has been resolved by ensuring `kfree_sensitive()` is used during device teardown, consistent with other code paths in the driver.
Affected products
- Linux Linux Kernel v6.10+
Timeline
- 2026-04-09: other: Vulnerability fixed in source code
- 2026-06-08: disclosed: CVE published