Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2025-71077

tpm: Cap the number of PCR banks

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, and 1 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

In the Linux kernel, the following vulnerability has been resolved: tpm: Cap the number of PCR banks tpm2_get_pcr_allocation() does not cap any upper limit for the number of banks. Cap the limit to eight banks so that out of bounds values coming from external I/O cause on only limited harm.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  3. Record last updated

Affected versions

  • Linux Linux

    From bcfff8384f6c4e6627676ef07ccad9cfacd67849 · fixed in 8ceee7288152bc121a6bf92997261838c78bfe06; From bcfff8384f6c4e6627676ef07ccad9cfacd67849 · fixed in 275c686f1e3cc056ec66c764489ec1fe1e51b950; From bcfff8384f6c4e6627676ef07ccad9cfacd67849 · fixed in ceb70d31da5671d298bad94ae6c20e4bbb800f96; From bcfff8384f6c4e6627676ef07ccad9cfacd67849 · fixed in d88481653d74d622d1d0d2c9bad845fc2cc6fd23; From bcfff8384f6c4e6627676ef07ccad9cfacd67849 · fixed in b69492161c056d36789aee42a87a33c18c8ed5e1; From bcfff8384f6c4e6627676ef07ccad9cfacd67849 · fixed in 858344bc9210bea9ab2bdc7e9e331ba84c164e50; From bcfff8384f6c4e6627676ef07ccad9cfacd67849 · fixed in faf07e611dfa464b201223a7253e9dc5ee0f3c9e

  • Linux Linux

    5.1

  • KernelLinux

    From 5.1.0 · fixed in 5.10.248; From 5.11.0 · fixed in 5.15.198; From 5.16.0 · fixed in 6.1.160; From 6.2.0 · fixed in 6.6.120; From 6.7.0 · fixed in 6.12.64; From 6.13.0 · fixed in 6.18.3

References 7

git.kernel.org