Sensitive Information in Resource Not Removed Before Reuse in Linux kernel - CVE-2026-46283

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU134249

Sensitive Information in Resource Not Removed Before Reuse in Linux kernel - CVE-2026-46283

Published: June 10, 2026


Vulnerability identifier: #VU134249
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-46283
CWE-ID: CWE-226
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to missing sensitive data clearing in tpm_dev_release() when releasing a TPM device. A local user can trigger device teardown to disclose sensitive information.

The freed structure may contain HMAC session keys, nonces, and passphrase data.


Affected software

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-azure (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-raspi (Ubuntu package)

How to mitigate CVE-2026-46283

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - update to 7.0.0-27.27
linux-azure (Ubuntu package) - addressed in versions 7.0.0-1009.9, 7.0.0-1010.10
linux-nvidia (Ubuntu package) - update to 7.0.0-1013.13
linux-raspi (Ubuntu package) - update to 7.0.0-1014.14

External References

Related Security Bulletins