EUVD-2026-76675
GHSA-wv58-h966-qv76
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition requires precise timing (AC:H); triggering key operation needs only PR:L, though module unload needs elevated privilege.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
KEYS: trusted: Fix TPM teardown ordering
trusted_tpm_exit() drops the TPM chip reference and frees the digest array before unregistering the trusted key type. key_type_lookup() holds key_types_sem for reading until the key operation finishes, while unregister_key_type() takes it for writing. It therefore provides the synchronization point that must precede backend teardown.
The current order permits this interleaving:
CPU 0 CPU 1 trusted_tpm_exit() key_type_lookup("trusted") put_device(&chip->dev) trusted_tpm_seal() kfree(digests) pcrlock() unregister_key_type() tpm_pcr_extend(..., digests)
CPU 1 can consequently dereference the freed digest array. The chip can also be released before callbacks stop using it.
KASAN reported:
BUG: KASAN: slab-use-after-free in tpm_pcr_extend+0x1f0/0x200 Read of size 2 at addr ffff88810872d000 by task poc/89 Call Trace: tpm_pcr_extend+0x1f0/0x200 pcrlock+0x42/0x70 [trusted] trusted_tpm_seal+0x1b6/0x570 [trusted] trusted_instantiate+0x293/0x340 [trusted] __key_instantiate_and_link+0xb2/0x2b0 __key_create_or_update+0x61e/0xb50 __do_sys_add_key+0x1b8/0x310 Allocated by task 88: __kmalloc_noprof+0x1a7/0x490 do_one_initcall+0xa1/0x390 do_init_module+0x2df/0x840 Freed by task 90: kfree+0x131/0x3c0 trusted_tpm_exit+0x59/0xa0 [trusted] __do_sys_delete_module+0x346/0x510
Move unregister_key_type() before releasing either resource. This stops new lookups and waits for in-flight key operations to finish before the backend state is destroyed.
AnalysisAI
Use-after-free in the Linux kernel's KEYS trusted TPM subsystem permits concurrent kernel threads to dereference freed memory during module teardown. trusted_tpm_exit() incorrectly releases the TPM chip reference and frees the digest array before calling unregister_key_type(), which is the actual synchronization barrier that drains in-flight key operations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the trusted_tpm kernel module loaded and a functional TPM chip accessible to the kernel; (2) a local account with sufficient privilege to create trusted keys (typically CAP_SYS_ADMIN or kernel keyring permissions, which are PR:L in this context); (3) concurrent module unloading - normally performed by root/PR:H - happening while a key operation is in flight; (4) winning a narrow timing race between the kfree(digests) and the in-flight tpm_pcr_extend() dereference. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8) overstates exploitability by assigning AC:L, which ignores the inherent race-window timing required to win the teardown/in-flight-operation race. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update to a patched kernel release: Linux 6.18.50, 7.2.4, or 7.3-rc1 as confirmed in EUVD affected-version data and upstream stable commits (753c978f, 2f7541af, 5e2d6722 at https://git.kernel.org/stable/c/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory production Linux systems using TPM key management by checking for tpm_trusted_key kernel module presence and any reliance on TPM for key operations or attestation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today