CVE-2026-46096

Analyzed Analyzed - Analysis Complete

Memory Leak in Linux Kernel TPM2 Session Handling

Publication date: 2026-05-27

Last updated on: 2026-06-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() tpm2_read_public() calls tpm_buf_init() but fails to call tpm_buf_destroy() on two exit paths, leaking a page allocation: 1. When name_size() returns an error (unrecognized hash algorithm), the function returns directly without destroying the buffer. 2. On the success path, the buffer is never destroyed before returning. All other error paths in the function correctly call tpm_buf_destroy() before returning. Fix both by adding the missing tpm_buf_destroy() calls.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-27

Last Modified

2026-06-25

Generated

2026-07-06

AI Q&A

2026-05-27

EPSS Evaluated

2026-07-05

NVD

CVE-2026-46096

EUVD

EUVD-2026-32479

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.19 (inc) to 7.0.4 (exc)
linux	linux_kernel	From 6.12.64 (inc) to 6.13 (exc)
linux	linux_kernel	From 6.18.3 (inc) to 6.18.27 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's tpm2-sessions component, specifically in the function tpm2_read_public(). The function calls tpm_buf_init() to initialize a buffer but fails to call tpm_buf_destroy() to properly free that buffer in two scenarios, causing a memory leak.

If name_size() returns an error due to an unrecognized hash algorithm, the function returns immediately without destroying the buffer.
On the successful execution path, the buffer is also never destroyed before returning.

All other error paths correctly destroy the buffer before returning. The fix involves adding the missing tpm_buf_destroy() calls to prevent the memory leak.

Impact Analysis

This vulnerability can lead to a memory leak in the Linux kernel when using the tpm2_read_public() function. Over time, repeated leaks could consume system memory unnecessarily, potentially degrading system performance or stability.

Mitigation Strategies

The vulnerability is fixed by ensuring that the tpm_buf_destroy() function is called properly in the tpm2_read_public() function to avoid leaking page allocations.

To mitigate this vulnerability immediately, update your Linux kernel to a version that includes the fix for this issue.

Hi! I’m here to help you understand CVE-2026-46096. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70