CVE-2026-46096 (GCVE-0-2026-46096)
Vulnerability from cvelistv5
Published
2026-05-27 12:58
Modified
2026-06-14 17:54
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() tpm2_read_public() calls tpm_buf_init() but fails to call tpm_buf_destroy() on two exit paths, leaking a page allocation: 1. When name_size() returns an error (unrecognized hash algorithm), the function returns directly without destroying the buffer. 2. On the success path, the buffer is never destroyed before returning. All other error paths in the function correctly call tpm_buf_destroy() before returning. Fix both by adding the missing tpm_buf_destroy() calls.
References
Impacted products
Vendor Product Version
Linux Linux Version: 20eda7c74b69fe9e1caf9b930a5c016bf8d755fa
Version: bda1cbf73c6e241267c286427f2ed52b5735d872
Version: bda1cbf73c6e241267c286427f2ed52b5735d872
Version: a3b7eb67225c486a2da357c5db3e386f4e64bcde
Version: 6.18.3   ≤
Version: 6.12.64   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/char/tpm/tpm2-sessions.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f8775d9d9062da662cc861f9ff7722a65896d4cd",
              "status": "affected",
              "version": "20eda7c74b69fe9e1caf9b930a5c016bf8d755fa",
              "versionType": "git"
            },
            {
              "lessThan": "2f434be87e256fd58254f60ddf5d7d58e775ca0b",
              "status": "affected",
              "version": "bda1cbf73c6e241267c286427f2ed52b5735d872",
              "versionType": "git"
            },
            {
              "lessThan": "f0f75a3d98b7959a8677b6363e23190f3018636b",
              "status": "affected",
              "version": "bda1cbf73c6e241267c286427f2ed52b5735d872",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a3b7eb67225c486a2da357c5db3e386f4e64bcde",
              "versionType": "git"
            },
            {
              "lessThan": "6.18.27",
              "status": "affected",
              "version": "6.18.3",
              "versionType": "semver"
            },
            {
              "lessThan": "6.13",
              "status": "affected",
              "version": "6.12.64",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/char/tpm/tpm2-sessions.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "6.18.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.4",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.12.64",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public()\n\ntpm2_read_public() calls tpm_buf_init() but fails to call\ntpm_buf_destroy() on two exit paths, leaking a page allocation:\n\n1. When name_size() returns an error (unrecognized hash algorithm),\n   the function returns directly without destroying the buffer.\n\n2. On the success path, the buffer is never destroyed before\n   returning.\n\nAll other error paths in the function correctly call\ntpm_buf_destroy() before returning.\n\nFix both by adding the missing tpm_buf_destroy() calls."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T17:54:06.722Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f8775d9d9062da662cc861f9ff7722a65896d4cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f434be87e256fd58254f60ddf5d7d58e775ca0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0f75a3d98b7959a8677b6363e23190f3018636b"
        }
      ],
      "title": "tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46096",
    "datePublished": "2026-05-27T12:58:56.233Z",
    "dateReserved": "2026-05-13T15:03:33.097Z",
    "dateUpdated": "2026-06-14T17:54:06.722Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.