CVE-2026-45871

tpm: st33zp24: Fix missing cleanup on get_burstcount() error

State: Published
Severity: Not scored
Published: May 27, 2026
Updated: May 27, 2026
Reserved: May 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

tpm: st33zp24: Fix missing cleanup on get_burstcount() error

get_burstcount() can return -EBUSY on timeout. When this happens, st33zp24_send() returns directly without releasing the locality acquired earlier.

Use goto out_err to ensure proper cleanup when get_burstcount() fails.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	bf38b8710892333cec2d8069644eb36ff435fd6f to before e0ce3da82341fcd6194175f1837946b2a894c625Affected bf38b8710892333cec2d8069644eb36ff435fd6f to before 7687133509cf66ced120b667fefd21f80bf17993Affected bf38b8710892333cec2d8069644eb36ff435fd6f to before 1256c6dc96d1e687e6e9b63088156ed07411b00cAffected bf38b8710892333cec2d8069644eb36ff435fd6f to before a51cff9be046e13e1c1b2fe45d5c48b582ec9b8cAffected bf38b8710892333cec2d8069644eb36ff435fd6f to before cc09d55f519e15355de343264a22ac6682b8305eAffected bf38b8710892333cec2d8069644eb36ff435fd6f to before ec15eb67fe9df87981b4829b901ec254273ca483Affected bf38b8710892333cec2d8069644eb36ff435fd6f to before 4fffb77d35d038f146e6192da583dbe4971d869eAffected bf38b8710892333cec2d8069644eb36ff435fd6f to before 3e91b44c93ad2871f89fc2a98c5e4fe6ca5db3d9Affected
LinuxLinux	4.1Affected before 4.1Not affected 5.10.252 through 5.10.Not affected 5.15.202 through 5.15.Not affected 6.1.165 through 6.1.Not affected 6.6.128 through 6.6.Not affected 6.12.75 through 6.12.Not affected 6.18.14 through 6.18.Not affected 6.19.4 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

bf38b8710892333cec2d8069644eb36ff435fd6f to before e0ce3da82341fcd6194175f1837946b2a894c625Affected
bf38b8710892333cec2d8069644eb36ff435fd6f to before 7687133509cf66ced120b667fefd21f80bf17993Affected
bf38b8710892333cec2d8069644eb36ff435fd6f to before 1256c6dc96d1e687e6e9b63088156ed07411b00cAffected
bf38b8710892333cec2d8069644eb36ff435fd6f to before a51cff9be046e13e1c1b2fe45d5c48b582ec9b8cAffected
bf38b8710892333cec2d8069644eb36ff435fd6f to before cc09d55f519e15355de343264a22ac6682b8305eAffected
bf38b8710892333cec2d8069644eb36ff435fd6f to before ec15eb67fe9df87981b4829b901ec254273ca483Affected
bf38b8710892333cec2d8069644eb36ff435fd6f to before 4fffb77d35d038f146e6192da583dbe4971d869eAffected
bf38b8710892333cec2d8069644eb36ff435fd6f to before 3e91b44c93ad2871f89fc2a98c5e4fe6ca5db3d9Affected

LinuxLinux

4.1Affected
before 4.1Not affected
5.10.252 through 5.10.*Not affected
5.15.202 through 5.15.*Not affected
6.1.165 through 6.1.*Not affected
6.6.128 through 6.6.*Not affected
6.12.75 through 6.12.*Not affected
6.18.14 through 6.18.*Not affected
6.19.4 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.