SB20261022464 - Return of Wrong Status Code in Linux kernel char tpm driver

Description

This security bulletin contains information about 1 vulnerability.

1) Return of Wrong Status Code (CVE-ID: CVE-2026-98845)

CWE-ID: CWE-393 - Return of Wrong Status Code

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to bypass TPM reset-attack protections and cause authentication sessions to use an uninitialized key handle.

The vulnerability exists due to an incorrect success return in the Linux kernel's tpm2_load_null() function when a null key name mismatch is detected. A local user can induce this mismatch during a TPM reset attack to leave the chip serving commands despite the integrity failure and cause tpm2_start_auth_session() to use an uninitialized stack value as the salt key handle.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/015fb29a748342a186f37b602ac70017098c8251
• https://git.kernel.org/stable/c/96c46c75b0d470b4204f9fe1bdb075cd2ebaebfa
• https://git.kernel.org/stable/c/a03d0c64cd827a622578623a78defd66b6593b82
• https://git.kernel.org/stable/c/f6599d8830fe7ddab7334cc17846fd9ac9a7fa50