Riskcovery

CVE-2026-45941

tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure

State
Published
Severity
Not scored
Published
May 27, 2026
Updated
May 27, 2026
Reserved
May 13, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure

get_burstcount() can return -EBUSY on timeout. When this happens, the function returns directly without releasing the locality that was acquired at the beginning of tpm_tis_i2c_send().

Use goto out_err to ensure proper cleanup when get_burstcount() fails.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • aad628c1d91a6db57e572e4c1f35e863d81061d7 to before 8f124c5582d443ac9fb690db26d08cab5d6ba76eAffected
  • aad628c1d91a6db57e572e4c1f35e863d81061d7 to before c24c9c4cab11858f22f309521ba7ea5b1e7385f2Affected
  • aad628c1d91a6db57e572e4c1f35e863d81061d7 to before 1bb8f8826d0748b4b92a98fb6b6dfe52081739f5Affected
  • aad628c1d91a6db57e572e4c1f35e863d81061d7 to before 948966e546f29af04391d98b8e378e4a7670c1c1Affected
  • aad628c1d91a6db57e572e4c1f35e863d81061d7 to before a61b8412e3eb8b71646dba867e8252d8560a1a27Affected
  • aad628c1d91a6db57e572e4c1f35e863d81061d7 to before 1a22048c1117cdfac185ba450aba67ed6b65dc87Affected
  • aad628c1d91a6db57e572e4c1f35e863d81061d7 to before 2f7a665e1323359d99c74301d1e180f5e2c40181Affected
  • aad628c1d91a6db57e572e4c1f35e863d81061d7 to before bbd6e97c836cbeb9606d7b7e5dcf8a1d89525713Affected
LinuxLinux
  • 3.7Affected
  • before 3.7Not affected
  • 5.10.252 through 5.10.*Not affected
  • 5.15.202 through 5.15.*Not affected
  • 6.1.165 through 6.1.*Not affected
  • 6.6.128 through 6.6.*Not affected
  • 6.12.75 through 6.12.*Not affected
  • 6.18.14 through 6.18.*Not affected
  • 6.19.4 through 6.19.*Not affected
  • 7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.