CVE-2026-89763

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KEYS: trusted: Fix TPM teardown ordering

trusted_tpm_exit() drops the TPM chip reference and frees the digest

array before unregistering the trusted key type. key_type_lookup()

holds key_types_sem for reading until the key operation finishes, while

unregister_key_type() takes it for writing. It therefore provides the

synchronization point that must precede backend teardown.

The current order permits this interleaving:

CPU 0 CPU 1

trusted_tpm_exit() key_type_lookup("trusted")

put_device(&chip->dev) trusted_tpm_seal()

kfree(digests) pcrlock()

unregister_key_type() tpm_pcr_extend(..., digests)

CPU 1 can consequently dereference the freed digest array. The chip can

also be released before callbacks stop using it.

KASAN reported:

BUG: KASAN: slab-use-after-free in tpm_pcr_extend+0x1f0/0x200

Read of size

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References