Improper resource shutdown or release in Linux kernel - CVE-2026-45871
Published: May 28, 2026
Vulnerability identifier: #VU132619
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-45871
CWE-ID: CWE-404
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown or release in st33zp24_send() in the st33zp24 TPM driver when handling a get_burstcount() timeout error. A local user can trigger the error condition to cause a denial of service.
The issue occurs because locality acquired earlier is not released when get_burstcount() returns -EBUSY on timeout.
How to mitigate CVE-2026-45871
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/1256c6dc96d1e687e6e9b63088156ed07411b00c
- https://git.kernel.org/stable/c/3e91b44c93ad2871f89fc2a98c5e4fe6ca5db3d9
- https://git.kernel.org/stable/c/4fffb77d35d038f146e6192da583dbe4971d869e
- https://git.kernel.org/stable/c/7687133509cf66ced120b667fefd21f80bf17993
- https://git.kernel.org/stable/c/a51cff9be046e13e1c1b2fe45d5c48b582ec9b8c
- https://git.kernel.org/stable/c/cc09d55f519e15355de343264a22ac6682b8305e
- https://git.kernel.org/stable/c/e0ce3da82341fcd6194175f1837946b2a894c625
- https://git.kernel.org/stable/c/ec15eb67fe9df87981b4829b901ec254273ca483