tpm: Use kfree_sensitive() to free auth session in tpm_dev_release()
Summary
| CVE | CVE-2026-46283 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-06-08 17:16:46 UTC |
| Updated | 2026-07-23 08:10:00 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() tpm_dev_release() uses plain kfree() to free chip->auth, which contains sensitive cryptographic material including HMAC session keys, nonces, and passphrase data (struct tpm2_auth). Every other code path that frees this structure uses kfree_sensitive() to zero the memory before releasing it: both tpm2_end_auth_session() and tpm_buf_check_hmac_response() do so. The tpm_dev_release() path is the only one that does not, leaving key material in freed slab memory until it is eventually overwritten. Use kfree_sensitive() for consistency with the rest of the driver and to ensure session keys are scrubbed during device teardown. |
Risk And Classification
Primary CVSS: v3.1 5.5 MEDIUM from [email protected]
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.001220000 probability, percentile 0.023500000 (date 2026-07-09)
Problem Types: NVD-CWE-noinfo
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
NoneAvailability
HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Linux | Linux Kernel | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected 699e3efd6c645c741ea4d6d58282c56b6d108cf7 dd3ac52ea7a001406c7dbc663aae4b9f89da679a git | Not specified |
| CNA | Linux | Linux | affected 699e3efd6c645c741ea4d6d58282c56b6d108cf7 53e6d2d834df40960b655b353e7a8ff4d927e1c7 git | Not specified |
| CNA | Linux | Linux | affected 699e3efd6c645c741ea4d6d58282c56b6d108cf7 84ced03172da544c9f8c0862faad48104f519352 git | Not specified |
| CNA | Linux | Linux | affected 699e3efd6c645c741ea4d6d58282c56b6d108cf7 c424d2664f08c77f08b4580b5f0cbaabf7c229b2 git | Not specified |
| CNA | Linux | Linux | affected 6.10 | Not specified |
| CNA | Linux | Linux | unaffected 6.10 semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.86 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.27 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.0.4 7.0.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.1 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/53e6d2d834df40960b655b353e7a8ff4d927e1c7 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | Patch |
| git.kernel.org/stable/c/dd3ac52ea7a001406c7dbc663aae4b9f89da679a | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | Patch |
| git.kernel.org/stable/c/c424d2664f08c77f08b4580b5f0cbaabf7c229b2 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | Patch |
| git.kernel.org/stable/c/84ced03172da544c9f8c0862faad48104f519352 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | Patch |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.