CVE-2026-46283 Details
Description
In the Linux kernel, the following vulnerability has been resolved: tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() tpm_dev_release() uses plain kfree() to free chip->auth, which contains sensitive cryptographic material including HMAC session keys, nonces, and passphrase data (struct tpm2_auth). Every other code path that frees this structure uses kfree_sensitive() to zero the memory before releasing it: both tpm2_end_auth_session() and tpm_buf_check_hmac_response() do so. The tpm_dev_release() path is the only one that does not, leaving key material in freed slab memory until it is eventually overwritten. Use kfree_sensitive() for consistency with the rest of the driver and to ensure session keys are scrubbed during device teardown.
A vulnerability exists in the Linux kernel's handling of TPM (Trusted Platform Module) authentication session data. The issue arises in the 'tpm_dev_release()' function, which uses the standard 'kfree()' to deallocate memory containing sensitive cryptographic information, such as HMAC session keys, nonces, and passphrase data. This approach leaves critical data in freed memory until it is overwritten, creating a potential security risk. In contrast, other functions that manage this data correctly use 'kfree_sensitive()' to clear the information before freeing it. This vulnerability affects Linux kernel versions 6.10 and later.
Users can upgrade to the latest version of the Linux kernel, where this vulnerability has been addressed by modifying the 'tpm_dev_release()' function to use 'kfree_sensitive()' instead of 'kfree()'.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/53e6d2d834df40960b655b353e7a8ff4d927e1c7 | kernel.org | Patch |
| https://git.kernel.org/stable/c/84ced03172da544c9f8c0862faad48104f519352 | kernel.org | Patch |
| https://git.kernel.org/stable/c/c424d2664f08c77f08b4580b5f0cbaabf7c229b2 | kernel.org | Patch |
| https://git.kernel.org/stable/c/dd3ac52ea7a001406c7dbc663aae4b9f89da679a | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.10, < 6.12.86 >= 6.13, < 6.18.27 >= 6.19, < 7.0.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jul 8, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 8, 2026 | New CVE Received | kernel.org |