CVE-2026-99221
Received Received - Intake

Trusted Key Unseal Failure in Linux Kernel

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: keys/trusted_keys: return immediately after TPM unseal failure trusted_tpm_unseal() proceeds to pcrlock() when the TPM unseal operation fails. If pcrlock() succeeds, its return value overwrites the unseal error, causing key instantiation to succeed. Return immediately when unseal fails to preserve the original error.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-99221

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
Linux Linux 5d0682be318910e028bdf57c90a1695ffc34be37
Linux Linux 5d0682be318910e028bdf57c90a1695ffc34be37
Linux Linux 5d0682be318910e028bdf57c90a1695ffc34be37
Linux Linux 5d0682be318910e028bdf57c90a1695ffc34be37
Linux Linux 5d0682be318910e028bdf57c90a1695ffc34be37
Linux Linux 5d0682be318910e028bdf57c90a1695ffc34be37
Linux Linux 5d0682be318910e028bdf57c90a1695ffc34be37
Linux Linux 5.13

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the trusted keys subsystem. When a TPM unseal operation fails, the function trusted_tpm_unseal() incorrectly proceeds to pcrlock() instead of returning immediately. If pcrlock() succeeds, it overwrites the unseal error, making it appear as though key instantiation succeeded when it actually failed.

Detection Guidance

This vulnerability is specific to the Linux kernel's trusted keys subsystem and TPM unseal operations. Detection requires checking kernel logs for TPM unseal failures or examining kernel code for the described issue. No direct network detection commands are applicable.

Impact Analysis

This vulnerability could allow an attacker to bypass security controls by causing a key operation to appear successful even when it fails. This might lead to unauthorized access to encrypted data or system resources protected by these keys.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR, HIPAA, or similar standards as it pertains to a specific Linux kernel key management flaw. Compliance risks would arise only if the vulnerability leads to unauthorized access or data breaches, which is not described here.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Monitor kernel logs for TPM unseal failures and ensure trusted keys are not improperly instantiated. Restart services using trusted keys after patching.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-99221. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...