CVE-2026-90070

tpm: st33zp24: Return zero on status read failure

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

tpm: st33zp24: Return zero on status read failure

st33zp24_status() ignores the result of the transport read and returns data even when no byte was received. The I2C transport, for example, skips i2c_master_recv() when the register-select write is short or fails, leaving data uninitialized. The resulting stack value can be interpreted as TPM_STS flags and let status checks complete spuriously.

The status callback cannot propagate a transport error. Return zero unless recv() reports exactly one byte. With no status bits set, callers retry or take their existing timeout or error path instead of acting on an invalid status value.

This issue was found by a static analysis checker and confirmed by manual source review.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	251a7b08213af82e40e4a70cac056e245853c410 to before d732cfc4befe28f02ec82ed5fd2bc2a21fbabd42Affected 251a7b08213af82e40e4a70cac056e245853c410 to before 4973e8386257eed10e5433a94a53bcc6ec37d2a1Affected 251a7b08213af82e40e4a70cac056e245853c410 to before 981307e2e8a930da492c2bcf763865c47c2a5165Affected 251a7b08213af82e40e4a70cac056e245853c410 to before 1bfd5c54e40704ce93d128a25de3d8dd772bf183Affected 251a7b08213af82e40e4a70cac056e245853c410 to before 38c26fe4522963a91d4fb02c844d8faa740fe9d1Affected 251a7b08213af82e40e4a70cac056e245853c410 to before 14feaa498c20c1b7ddefe27de5329aaff822cc0dAffected 251a7b08213af82e40e4a70cac056e245853c410 to before e6d7d9b665419cda3e9f91030d81c9f8ba71e51dAffected 251a7b08213af82e40e4a70cac056e245853c410 to before 8b92687708f5ef980de01c2042dbd76d11f78547Affected
LinuxLinux	3.9Affected before 3.9Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

251a7b08213af82e40e4a70cac056e245853c410 to before d732cfc4befe28f02ec82ed5fd2bc2a21fbabd42Affected
251a7b08213af82e40e4a70cac056e245853c410 to before 4973e8386257eed10e5433a94a53bcc6ec37d2a1Affected
251a7b08213af82e40e4a70cac056e245853c410 to before 981307e2e8a930da492c2bcf763865c47c2a5165Affected
251a7b08213af82e40e4a70cac056e245853c410 to before 1bfd5c54e40704ce93d128a25de3d8dd772bf183Affected
251a7b08213af82e40e4a70cac056e245853c410 to before 38c26fe4522963a91d4fb02c844d8faa740fe9d1Affected
251a7b08213af82e40e4a70cac056e245853c410 to before 14feaa498c20c1b7ddefe27de5329aaff822cc0dAffected
251a7b08213af82e40e4a70cac056e245853c410 to before e6d7d9b665419cda3e9f91030d81c9f8ba71e51dAffected
251a7b08213af82e40e4a70cac056e245853c410 to before 8b92687708f5ef980de01c2042dbd76d11f78547Affected

LinuxLinux

3.9Affected
before 3.9Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.