CVE-2026-89763
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trusted_tpm_exit() drops the TPM chip reference and frees the digest array before unregistering the trusted key type. key_type_lookup() holds key_types_sem for reading until the key operation finishes, while unregister_key_type() takes it for writing. It therefore provides the synchronization point that must precede backend teardown. The current order permits this interleaving: CPU 0 CPU 1 trusted_tpm_exit() key_type_lookup("trusted") put_device(&chip->dev) trusted_tpm_seal() kfree(digests) pcrlock() unregister_key_type() tpm_pcr_extend(..., digests) CPU 1 can consequently dereference the freed digest array. The chip can also be released before callbacks stop using it. KASAN reported: BUG: KASAN: slab-use-after-free in tpm_pcr_extend+0x1f0/0x200 Read of size 2 at addr ffff88810872d000 by task poc/89 Call Trace: tpm_pcr_extend+0x1f0/0x200 pcrlock+0x42/0x70 [trusted] trusted_tpm_seal+0x1b6/0x570 [trusted] trusted_instantiate+0x293/0x340 [trusted] __key_instantiate_and_link+0xb2/0x2b0 __key_create_or_update+0x61e/0xb50 __do_sys_add_key+0x1b8/0x310 Allocated by task 88: __kmalloc_noprof+0x1a7/0x490 do_one_initcall+0xa1/0x390 do_init_module+0x2df/0x840 Freed by task 90: kfree+0x131/0x3c0 trusted_tpm_exit+0x59/0xa0 [trusted] __do_sys_delete_module+0x346/0x510 Move unregister_key_type() before releasing either resource. This stops new lookups and waits for in-flight key operations to finish before the backend state is destroyed.
View original CVE JSON
{
"id": "CVE-2026-89763",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-09-11T20:20:07.523",
"lastModified": "2026-10-30T13:20:28.847",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: trusted: Fix TPM teardown ordering\n\ntrusted_tpm_exit() drops the TPM chip reference and frees the digest\narray before unregistering the trusted key type. key_type_lookup()\nholds key_types_sem for reading until the key operation finishes, while\nunregister_key_type() takes it for writing. It therefore provides the\nsynchronization point that must precede backend teardown.\n\nThe current order permits this interleaving:\n\n CPU 0 CPU 1\n trusted_tpm_exit() key_type_lookup(\"trusted\")\n put_device(&chip->dev) trusted_tpm_seal()\n kfree(digests) pcrlock()\n unregister_key_type() tpm_pcr_extend(..., digests)\n\nCPU 1 can consequently dereference the freed digest array. The chip can\nalso be released before callbacks stop using it.\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in tpm_pcr_extend+0x1f0/0x200\n Read of size 2 at addr ffff88810872d000 by task poc/89\n Call Trace:\n tpm_pcr_extend+0x1f0/0x200\n pcrlock+0x42/0x70 [trusted]\n trusted_tpm_seal+0x1b6/0x570 [trusted]\n trusted_instantiate+0x293/0x340 [trusted]\n __key_instantiate_and_link+0xb2/0x2b0\n __key_create_or_update+0x61e/0xb50\n __do_sys_add_key+0x1b8/0x310\n Allocated by task 88:\n __kmalloc_noprof+0x1a7/0x490\n do_one_initcall+0xa1/0x390\n do_init_module+0x2df/0x840\n Freed by task 90:\n kfree+0x131/0x3c0\n trusted_tpm_exit+0x59/0xa0 [trusted]\n __do_sys_delete_module+0x346/0x510\n\nMove unregister_key_type() before releasing either resource. This stops\nnew lookups and waits for in-flight key operations to finish before the\nbackend state is destroyed."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"security/keys/trusted-keys/trusted_tpm1.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400",
"lessThan": "b254cdadbcb6bdd0daf7391d63b3b97b2bec1ad9",
"versionType": "git",
"status": "affected"
},
{
"version": "0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400",
"lessThan": "c96518231608bbf9568f539aadb20a8e366b54c7",
"versionType": "git",
"status": "affected"
},
{
"version": "0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400",
"lessThan": "6564808189c9a1e682ee7b5e70f5f1c73c89c3a4",
"versionType": "git",
"status": "affected"
},
{
"version": "0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400",
"lessThan": "81dfc6c665547a4e41721b6716f894f263a5e03f",
"versionType": "git",
"status": "affected"
},
{
"version": "0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400",
"lessThan": "3d67b4acbfc7af331d887a8efc04bef6573b8a7a",
"versionType": "git",
"status": "affected"
},
{
"version": "0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400",
"lessThan": "753c978f2400f9783eb524842a975d3ac950d511",
"versionType": "git",
"status": "affected"
},
{
"version": "0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400",
"lessThan": "2f7541afbc57fe9d26769a22c31d8ce8790c9a19",
"versionType": "git",
"status": "affected"
},
{
"version": "0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400",
"lessThan": "5e2d672280d97d83de43031d93761b12dadd7b8a",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"security/keys/trusted-keys/trusted_tpm1.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "5.1",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.1",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.273",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.224",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.191",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.160",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.111",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.50",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2.4",
"lessThanOrEqual": "7.2.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.3",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-16T19:26:34.436196Z",
"id": "CVE-2026-89763",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2f7541afbc57fe9d26769a22c31d8ce8790c9a19",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3d67b4acbfc7af331d887a8efc04bef6573b8a7a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5e2d672280d97d83de43031d93761b12dadd7b8a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6564808189c9a1e682ee7b5e70f5f1c73c89c3a4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/753c978f2400f9783eb524842a975d3ac950d511",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/81dfc6c665547a4e41721b6716f894f263a5e03f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b254cdadbcb6bdd0daf7391d63b3b97b2bec1ad9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c96518231608bbf9568f539aadb20a8e366b54c7",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}