Riskcovery

CVE-2026-98728

tpm: fix off-by-four bounds check in tpm2_get_random()

State
Published
Severity
Not scored
Published
Oct 18, 2026
Updated
Oct 19, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

tpm: fix off-by-four bounds check in tpm2_get_random()

When the response carries the TPM2_ST_SESSIONS tag, tpm2_get_random() skips the 4-byte parameter size field before locating the random data, but the bounds check still validates the response length against TPM_HEADER_SIZE. A truncated response can pass the check and make memcpy() read up to 4 bytes past the response end, so stale buffer contents end up in the caller's random bytes.

Fix this by checking the response length against 'offset', which already includes the skipped parameter size field.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497 to before be54101992c2c5218be0e0a87827ccc96e3089afAffected
  • 1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497 to before e30a2406408d2df6d9cd48c2e59e913cf266a05aAffected
  • 1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497 to before 42bb6216b861e892512128219ff23010d656ba14Affected
  • 1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497 to before 9b522400bf5c082feb9a0037a053ea822a2c7e4dAffected
LinuxLinux
  • 6.10Affected
  • before 6.10Not affected
  • 6.12.113 through 6.12.*Not affected
  • 6.18.56 through 6.18.*Not affected
  • 7.2.10 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.