Skip to main content

Linux Kernel CVE-2025-68792

HIGH
2026-01-13 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Buffer Overflow Linux Red Hat Suse
High
Disputed · 7.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Sources disagree (Low–High)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local-only kernel path (AV:L) reachable by a low-privileged user (PR:L) with no interaction; memory corruption yields high C/I/A within an unchanged scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.3 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Jul 30, 2026 - 07:24 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 30, 2026 - 07:23 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Jan 13, 2026 - 16:16 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

tpm2-sessions: Fix out of range indexing in name_size

'name_size' does not have any range checks, and it just directly indexes with TPM_ALG_ID, which could lead into memory corruption at worst.

Address the issue by only processing known values and returning -EINVAL for unrecognized values.

Make also 'tpm_buf_append_name' and 'tpm_buf_fill_hmac_session' fallible so that errors are detected before causing any spurious TPM traffic.

End also the authorization session on failure in both of the functions, as the session state would be then by definition corrupted.

AnalysisAI

Memory corruption in the Linux kernel's TPM 2.0 session-handling code (tpm2-sessions) arises because the 'name_size' value derived from a TPM_ALG_ID is used to index without range validation, so an unrecognized or malicious algorithm identifier can drive an out-of-bounds access. The affected TPM HMAC/authorization session path is reachable from local, low-privileged kernel-driver interactions; at worst this leads to kernel memory corruption affecting confidentiality, integrity, and availability. No public exploit is identified at time of analysis and the EPSS probability is negligible (0.03%), consistent with a locally-scoped kernel hardening fix rather than a mass-exploited flaw.

Technical ContextAI

The vulnerability lives in the kernel's TPM 2.0 command layer, specifically the tpm2-sessions module that constructs authenticated (HMAC) sessions with a TPM chip. TPM names and session HMACs are keyed to a hash algorithm identified by a TPM_ALG_ID enumerated value; the code looked up 'name_size' by indexing a table with that algorithm ID directly. Because the ID came from data without bounds checks, an out-of-range or unrecognized TPM_ALG_ID indexes past the valid table, an out-of-bounds read/write class of bug (CWE-125/CWE-787, an out-of-bounds indexing weakness, though the CVE lists CWE as N/A and tags it 'Buffer Overflow'). The fix restricts processing to known algorithm values and returns -EINVAL otherwise, and additionally makes tpm_buf_append_name() and tpm_buf_fill_hmac_session() fallible so errors are caught before spurious TPM traffic, ending the authorization session on failure since its state would be corrupted.

Affected ProductsAI

The affected component is the Linux kernel's TPM 2.0 session subsystem (drivers/char/tpm, tpm2-sessions). No explicit version range or CPE string was provided in the intelligence; affected versions are those including the vulnerable tpm2-sessions name_size indexing prior to the stable fixes referenced at git.kernel.org (commits 04a3aa6e8c5f878cc51a8a1c90b6d3c54079bc43, 47e676ce4d68f461dfcab906f6aeb254f7276deb, and 6e9722e9a7bfe1bbad649937c811076acf86e1fd). Distribution-specific impact is tracked by Ubuntu in USN-8177-1 (https://ubuntu.com/security/notices/USN-8177-1) and cataloged by VulDB at https://vuldb.com/?id.340675; consult those advisories for exact kernel package versions per release.

RemediationAI

Patch available per vendor advisory: apply the upstream stable-tree fixes referenced at git.kernel.org (commits 04a3aa6e8c5f878cc51a8a1c90b6d3c54079bc43, 47e676ce4d68f461dfcab906f6aeb254f7276deb, 6e9722e9a7bfe1bbad649937c811076acf86e1fd), or install the corresponding distribution kernel update - Ubuntu users should follow USN-8177-1 (https://ubuntu.com/security/notices/USN-8177-1) and reboot into the patched kernel. Because the flaw is only reachable through the TPM 2.0 session path, a compensating control where patching must be deferred is to restrict local access and, on systems that do not require it, disable or unbind the TPM driver / avoid exposing TPM device nodes (e.g. /dev/tpm0, /dev/tpmrm0) to untrusted local users; the trade-off is loss of measured boot, TPM-backed key sealing, and any attestation or disk-encryption features that depend on the TPM. Tighten permissions on TPM device files so only trusted services can issue commands. Cross-reference VulDB entry https://vuldb.com/?id.340675 for tracking.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Image SLES-Azure-3P Image SLES-Azure-Basic Image SLES-Azure-Standard Image SLES-BYOS-Azure Image SLES-BYOS-EC2 Image SLES-BYOS-GCE Image SLES-CHOST-BYOS-Aliyun Image SLES-CHOST-BYOS-Azure Image SLES-CHOST-BYOS-EC2 Image SLES-CHOST-BYOS-GCE Image SLES-CHOST-BYOS-GDC Image SLES-CHOST-BYOS-SAP-CCloud Image SLES-EC2 Image SLES-EC2-ECS Image SLES-GCE Image SLES-GCE-3P Image SLES-Hardened-BYOS-Azure Image SLES-Hardened-BYOS-EC2 Image SLES-Hardened-BYOS-GCE Image SLES-SAPCAL-Azure Image SLES-SAPCAL-EC2 Image SLES-SAPCAL-GCE Affected
Image SLES-SAP-Azure Image SLES-SAP-Azure-3P Image SLES-SAP-BYOS-Azure Image SLES-SAP-BYOS-EC2 Image SLES-SAP-BYOS-GCE Image SLES-SAP-EC2 Image SLES-SAP-GCE Image SLES-SAP-GCE-3P Affected
SUSE Linux Enterprise High Availability Extension 16.0 Fixed
SUSE Linux Enterprise Server 16.0 Fixed

Share

CVE-2025-68792 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy