CVE-2026-89763

KEYS: trusted: Fix TPM teardown ordering

State: Published
Severity: 7.8 High
Published: Sep 11, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

KEYS: trusted: Fix TPM teardown ordering

trusted_tpm_exit() drops the TPM chip reference and frees the digest array before unregistering the trusted key type. key_type_lookup() holds key_types_sem for reading until the key operation finishes, while unregister_key_type() takes it for writing. It therefore provides the synchronization point that must precede backend teardown.

The current order permits this interleaving:

CPU 0 CPU 1 trusted_tpm_exit() key_type_lookup("trusted") put_device(&chip->dev) trusted_tpm_seal() kfree(digests) pcrlock() unregister_key_type() tpm_pcr_extend(..., digests)

CPU 1 can consequently dereference the freed digest array. The chip can also be released before callbacks stop using it.

KASAN reported:

BUG: KASAN: slab-use-after-free in tpm_pcr_extend+0x1f0/0x200 Read of size 2 at addr ffff88810872d000 by task poc/89 Call Trace: tpm_pcr_extend+0x1f0/0x200 pcrlock+0x42/0x70 [trusted] trusted_tpm_seal+0x1b6/0x570 [trusted] trusted_instantiate+0x293/0x340 [trusted] __key_instantiate_and_link+0xb2/0x2b0 __key_create_or_update+0x61e/0xb50 __do_sys_add_key+0x1b8/0x310 Allocated by task 88: __kmalloc_noprof+0x1a7/0x490 do_one_initcall+0xa1/0x390 do_init_module+0x2df/0x840 Freed by task 90: kfree+0x131/0x3c0 trusted_tpm_exit+0x59/0xa0 [trusted] __do_sys_delete_module+0x346/0x510

Move unregister_key_type() before releasing either resource. This stops new lookups and waits for in-flight key operations to finish before the backend state is destroyed.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400 to before b254cdadbcb6bdd0daf7391d63b3b97b2bec1ad9Affected 0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400 to before c96518231608bbf9568f539aadb20a8e366b54c7Affected 0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400 to before 6564808189c9a1e682ee7b5e70f5f1c73c89c3a4Affected 0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400 to before 81dfc6c665547a4e41721b6716f894f263a5e03fAffected 0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400 to before 3d67b4acbfc7af331d887a8efc04bef6573b8a7aAffected 0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400 to before 753c978f2400f9783eb524842a975d3ac950d511Affected 0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400 to before 2f7541afbc57fe9d26769a22c31d8ce8790c9a19Affected 0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400 to before 5e2d672280d97d83de43031d93761b12dadd7b8aAffected
LinuxLinux	5.1Affected before 5.1Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.50 through 6.18.Not affected 7.2.4 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400 to before b254cdadbcb6bdd0daf7391d63b3b97b2bec1ad9Affected
0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400 to before c96518231608bbf9568f539aadb20a8e366b54c7Affected
0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400 to before 6564808189c9a1e682ee7b5e70f5f1c73c89c3a4Affected
0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400 to before 81dfc6c665547a4e41721b6716f894f263a5e03fAffected
0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400 to before 3d67b4acbfc7af331d887a8efc04bef6573b8a7aAffected
0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400 to before 753c978f2400f9783eb524842a975d3ac950d511Affected
0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400 to before 2f7541afbc57fe9d26769a22c31d8ce8790c9a19Affected
0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400 to before 5e2d672280d97d83de43031d93761b12dadd7b8aAffected

LinuxLinux

5.1Affected
before 5.1Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.50 through 6.18.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.