GHSA-wq6x-xf86-6rwfunknown
In the Linux kernel, the following vulnerability has been resolved: tpm2-sessions: Fix missing...
🔗 CVE IDs covered (1)
📋 Description
In the Linux kernel, the following vulnerability has been resolved:
tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public()
tpm2_read_public() calls tpm_buf_init() but fails to call tpm_buf_destroy() on two exit paths, leaking a page allocation:
-
When name_size() returns an error (unrecognized hash algorithm), the function returns directly without destroying the buffer.
-
On the success path, the buffer is never destroyed before returning.
All other error paths in the function correctly call tpm_buf_destroy() before returning.
Fix both by adding the missing tpm_buf_destroy() calls.
🔗 References (5)
- https://nvd.nist.gov/vuln/detail/CVE-2026-46096
- https://git.kernel.org/stable/c/2f434be87e256fd58254f60ddf5d7d58e775ca0b
- https://git.kernel.org/stable/c/f0f75a3d98b7959a8677b6363e23190f3018636b
- https://git.kernel.org/stable/c/f8775d9d9062da662cc861f9ff7722a65896d4cd
- https://github.com/advisories/GHSA-wq6x-xf86-6rwf