Detection of Error Condition Without Action in Linux kernel - CVE-2026-99221
Published: November 3, 2026
Vulnerability identifier: #VU158737
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-99221
CWE-ID: CWE-390
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to instantiate a trusted key despite failure of the TPM unseal operation.
The vulnerability exists due to improper handling of a detected TPM unseal error in trusted_tpm_unseal() when processing trusted key instantiation requests with PCR locking enabled. A local user can attempt key instantiation under conditions where TPM unsealing fails but pcrlock() succeeds to have the successful PCR locking return value overwrite the unseal error and cause key instantiation to succeed.
Affected software
Linux kernel
How to mitigate CVE-2026-99221
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/234d09bb3b3d84851d4b3246272addc30f3353eb
- https://git.kernel.org/stable/c/2d92a0f87c338a08367aff05edd1ade86da4ac8d
- https://git.kernel.org/stable/c/4876f09ce222e140a73aad950882b3605440c935
- https://git.kernel.org/stable/c/63b19ec2863b2cb5279b746ecd3d6210b1a93945
- https://git.kernel.org/stable/c/6e359d8cb8580b9874801dea930086effd4d9c62
- https://git.kernel.org/stable/c/e55d48f21f591a9fe80d26b5fbd1912ea725d9e6
- https://git.kernel.org/stable/c/ed697a5f667435bbb1cedbe5bd9f300de645047d