CVE-2026-89763

Received Received - Intake

Use-After-Free in Linux Kernel Trusted Key Type

Publication date: 2026-09-11

Last updated on: 2026-09-21

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trusted_tpm_exit() drops the TPM chip reference and frees the digest array before unregistering the trusted key type. key_type_lookup() holds key_types_sem for reading until the key operation finishes, while unregister_key_type() takes it for writing. It therefore provides the synchronization point that must precede backend teardown. The current order permits this interleaving: CPU 0 CPU 1 trusted_tpm_exit() key_type_lookup("trusted") put_device(&chip->dev) trusted_tpm_seal() kfree(digests) pcrlock() unregister_key_type() tpm_pcr_extend(..., digests) CPU 1 can consequently dereference the freed digest array. The chip can also be released before callbacks stop using it. KASAN reported: BUG: KASAN: slab-use-after-free in tpm_pcr_extend+0x1f0/0x200 Read of size 2 at addr ffff88810872d000 by task poc/89 Call Trace: tpm_pcr_extend+0x1f0/0x200 pcrlock+0x42/0x70 [trusted] trusted_tpm_seal+0x1b6/0x570 [trusted] trusted_instantiate+0x293/0x340 [trusted] __key_instantiate_and_link+0xb2/0x2b0 __key_create_or_update+0x61e/0xb50 __do_sys_add_key+0x1b8/0x310 Allocated by task 88: __kmalloc_noprof+0x1a7/0x490 do_one_initcall+0xa1/0x390 do_init_module+0x2df/0x840 Freed by task 90: kfree+0x131/0x3c0 trusted_tpm_exit+0x59/0xa0 [trusted] __do_sys_delete_module+0x346/0x510 Move unregister_key_type() before releasing either resource. This stops new lookups and waits for in-flight key operations to finish before the backend state is destroyed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-21

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-89763

EUVD

EUVD-2026-76675

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect teardown ordering in the trusted key type mechanism. The trusted_tpm_exit() function releases the TPM chip reference and frees memory before unregistering the trusted key type, allowing a race condition where another CPU can still access freed memory during key operations like sealing or extending PCRs.

Detection Guidance

This vulnerability is specific to the Linux kernel and requires kernel-level detection. Check kernel logs for KASAN reports or slab-use-after-free errors. Use commands like dmesg | grep -i kasan or journalctl -k | grep -i slab-use-after-free to detect crashes. Ensure your kernel is updated to a patched version.

Impact Analysis

This flaw could lead to system crashes, data corruption, or privilege escalation if exploited. Attackers might trigger use-after-free errors to execute arbitrary code or cause denial-of-service conditions by manipulating key operations during TPM teardown.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel memory management issue that could lead to system instability or crashes due to use-after-free errors. Compliance impacts would only occur if such failures disrupt data processing or security controls, which is not specified in the provided context.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for CVE-2026-89763. Avoid using the trusted key type with TPM until patched. Monitor system logs for crashes or memory corruption issues.

Hi! I’m here to help you understand CVE-2026-89763. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70