Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-98221

KEYS: trusted: Fix tpm2_load_cmd() boundary check

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, and 1 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix tpm2_load_cmd() boundary check tpm2_load_cmd() does boundary checks against the ASN.1 size i.e., payload->blob_len. Address this by passing the decoded blob size to tpm2_load_cmd(), and use it for the boundary checks.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From f2219745250f388edacabe6cca73654131c67d0a · fixed in cc86227fea28aed86c1fb52a884560b4440da198; From f2219745250f388edacabe6cca73654131c67d0a · fixed in b020b447338872440142fe8a57350a483da86b7a; From f2219745250f388edacabe6cca73654131c67d0a · fixed in 3fd487c69ad3161e358c33c170bab0cf02a071b7; From f2219745250f388edacabe6cca73654131c67d0a · fixed in 5afa57ea91481c6c49f194b0f5a5c4d96a4d7348; From f2219745250f388edacabe6cca73654131c67d0a · fixed in 9ddbc5f4bb498aff8096a5231574858a4bffee4f; From f2219745250f388edacabe6cca73654131c67d0a · fixed in 134825dfc971fbf2b1d0f58f0b3bce8332ad0afb; From f2219745250f388edacabe6cca73654131c67d0a · fixed in 114f00d738f15dd8c7318369edcdc53dd6d08763

  • Linux Linux

    5.13

  • KernelLinux

    From 5.13.0 · fixed in 5.15.222; From 5.16.0 · fixed in 6.1.189; From 6.2.0 · fixed in 6.6.158; From 6.7.0 · fixed in 6.12.112; From 6.13.0 · fixed in 6.18.54; From 6.19.0 · fixed in 7.2.8

References 7

git.kernel.org