Skip to main content

Linux Kernel EUVDEUVD-2026-32225

| CVE-2026-45941 MEDIUM
Memory Leak (CWE-401)
2026-05-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-5p3c-43qg-83mf
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access with standard privileges required to reach the TPM send path; no confidentiality or integrity impact, only TPM availability loss via locality exhaustion.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 24, 2026 - 17:26 vuln.today
CVSS changed
Jun 24, 2026 - 17:22 NVD
5.5 (MEDIUM)
Patch available
May 27, 2026 - 19:46 EUVD
CVE Published
May 27, 2026 - 14:17 nvd
MEDIUM 5.5
CVE Published
May 27, 2026 - 14:17 nvd
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure

get_burstcount() can return -EBUSY on timeout. When this happens, the function returns directly without releasing the locality that was acquired at the beginning of tpm_tis_i2c_send().

Use goto out_err to ensure proper cleanup when get_burstcount() fails.

AnalysisAI

TPM locality leak in the Linux kernel's tpm_i2c_infineon driver allows a local user on an affected system to exhaust TPM localities and render the TPM device unavailable. The tpm_tis_i2c_send() function acquires a TPM locality at entry but fails to release it when get_burstcount() times out with -EBUSY, causing a resource leak on every such timeout. Patches are available across multiple stable kernel branches; no public exploit code or active exploitation (CISA KEV) has been identified, and EPSS is 0.02% at the 7th percentile.

Technical ContextAI

The flaw is in drivers/char/tpm/tpm_i2c_infineon.c, the Linux kernel driver for Infineon I2C-connected Trusted Platform Module chips. TPM localities are hardware-enforced access control segments - a driver that acquires a locality must release it before returning to prevent resource exhaustion, making this a textbook CWE-401 (Improper Release of Memory Before Removing Last Reference, applied here to a hardware resource handle). The tpm_tis_i2c_send() send path acquires a locality at the top of the function, then calls get_burstcount() to determine the TPM's write burst capacity; if the TPM is busy and get_burstcount() times out returning -EBUSY, the original code returned immediately, skipping locality release. The upstream fix introduces a goto out_err cleanup path mirroring the existing success path's release logic. All CPE entries are cpe:2.3:o:linux:linux_kernel, covering affected kernel versions prior to the stable-branch patch points.

RemediationAI

Update to a patched kernel version on the applicable stable branch: 5.10.252+, 5.15.202+, 6.1.165+, 6.6.128+, 6.12.75+, 6.18.14+, 6.19.4+, or 7.0+. Upstream fix commits are available at https://git.kernel.org/stable/c/1a22048c1117cdfac185ba450aba67ed6b65dc87 and the companion commits listed in references; distribution vendors (Debian, Ubuntu, RHEL, SUSE) will ship backported kernel packages in their normal security update channels. For systems where an immediate kernel upgrade is not feasible, the tpm_i2c_infineon module can be blacklisted by adding 'blacklist tpm_i2c_infineon' to /etc/modprobe.d/ and rebuilding the initramfs - note this disables all TPM-dependent operations including disk encryption key unsealing (LUKS via TPM), measured boot/remote attestation, and any application using the TPM via /dev/tpm0 or /dev/tpmrm0, which may violate security policy or prevent system boot on configurations relying on TPM-sealed keys.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-32225 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy