Executive brief
The Linux kernel's trusted keys subsystem contains a race condition in TPM (Trusted Platform Module) cleanup code that can lead to use-after-free memory access. An attacker with local access could exploit this during module unload to crash the kernel or potentially execute code, disrupting system availability and security operations that depend on TPM-backed key management.
Technical details
The vulnerability is a use-after-free in the trusted_tpm_exit() function caused by incorrect teardown ordering. The kernel frees the digest array and releases the TPM chip reference before unregistering the trusted key type. Since key_type_lookup() acquires a read lock on key_types_sem that persists through key operations, in-flight operations can dereference the freed digest buffer. The race permits CPU 1 to call tpm_pcr_extend() on freed memory while CPU 0 is tearing down the module. The fix reorders unregister_key_type() to execute before resource cleanup, ensuring the lock serializes in-flight operations and prevents further key type lookups before teardown completes.
Affected products
- Linux Linux kernel affected versions not specified in advisory
Timeline
- 2026-09-11: disclosed