CVE-2026-72151

Received Received - Intake

Use-After-Free in Linux Kernel TPM Session Handling

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt tpm_buf_append_salt() in drivers/char/tpm/tpm2-sessions.c calls crypto_kpp_generate_public_key() and crypto_kpp_compute_shared_secret() without installing a completion callback, discards both return values, and immediately frees the kpp_request via kpp_request_free(). When the resolved ecdh-nist-p256 KPP backend is asynchronous (atmel-ecc, HPRE, keembay-ocs), either operation returns -EINPROGRESS and the deferred completion worker dereferences the freed request. The path fires automatically from the hwrng_fillfn kernel thread via tpm_get_random -> tpm2_get_random -> tpm2_start_auth_session -> tpm_buf_append_salt on every entropy poll, without any userland action. Install crypto_req_done as the completion callback, wrap both KPP operations in crypto_wait_req(), and propagate errors to the caller. The wait is a no-op for synchronous backends.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72151

EUVD

EUVD-2026-58909

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a missing completion callback in tpm_buf_append_salt() when calling asynchronous KPP operations. The function calls crypto_kpp_generate_public_key() and crypto_kpp_compute_shared_secret() without waiting for completion, frees the request immediately, and causes a use-after-free when the deferred worker tries to access the freed memory. This happens automatically during entropy polling via hwrng_fillfn.

Detection Guidance

This vulnerability is specific to the Linux kernel's TPM (Trusted Platform Module) implementation and may not have direct network detection methods. Check kernel logs for errors related to tpm2-sessions or KPP operations. Commands like dmesg | grep -i tpm or journalctl -k | grep -i tpm may help identify issues.

Impact Analysis

This vulnerability could lead to kernel memory corruption, crashes, or privilege escalation if exploited. Since it triggers automatically during entropy collection, it may cause system instability or unexpected behavior without user interaction.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it involves a low-level kernel cryptographic operation (TPM session handling) that could lead to memory corruption or crashes. Standards like GDPR and HIPAA focus on data protection and system integrity, but this issue is more about kernel stability and security rather than direct regulatory compliance impacts.

Mitigation Strategies

Update your Linux kernel to a patched version that resolves CVE-2026-72151. Monitor kernel security advisories and apply updates promptly. If immediate patching is not possible, consider disabling the affected TPM functionality if not required.

Hi! I’m here to help you understand CVE-2026-72151. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70