PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45871 Linux CVE debrief

A resource leak vulnerability exists in the Linux kernel's TPM ST33ZP24 driver. When the `get_burstcount()` function returns `-EBUSY` due to a timeout condition, the `st33zp24_send()` function exits directly without releasing the TPM locality that was previously acquired. This failure to properly clean up resources could lead to resource exhaustion or denial of service conditions affecting TPM operations. The vulnerability was resolved by modifying the error handling path to use `goto out_err`, ensuring consistent cleanup of acquired resources regardless of where the failure occurs.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-25
Advisory published
2026-05-27
Advisory updated
2026-06-25

Who should care

System administrators managing Linux systems with ST33ZP24 TPM hardware, security teams tracking kernel-level resource exhaustion vulnerabilities, and organizations relying on TPM-backed security functions requiring high availability.

Technical summary

The ST33ZP24 TPM driver in the Linux kernel contains a resource management flaw where `get_burstcount()` timeout errors (`-EBUSY`) cause premature function exit without releasing acquired TPM locality. The fix standardizes error handling to use `goto out_err` for guaranteed cleanup.

Defensive priority

medium

Recommended defensive actions

  • Review kernel configurations to identify systems utilizing the ST33ZP24 TPM driver
  • Apply kernel updates containing the referenced stable commits when available from distribution vendors
  • Monitor for kernel package updates addressing CVE-2026-45871
  • Consider TPM hardware alternatives or driver configurations if immediate patching is not feasible
  • Audit systems for signs of TPM resource exhaustion or related stability issues

Evidence notes

The vulnerability description indicates a missing cleanup path in the TPM ST33ZP24 driver when `get_burstcount()` returns `-EBUSY`. The fix ensures proper locality release via `goto out_err`. Multiple stable kernel commits are referenced, indicating backports to various kernel versions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45871 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45871

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45871 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45871

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1256c6dc96d1e687e6e9b63088156ed07411b00c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3e91b44c93ad2871f89fc2a98c5e4fe6ca5db3d9

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4fffb77d35d038f146e6192da583dbe4971d869e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/7687133509cf66ced120b667fefd21f80bf17993

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a51cff9be046e13e1c1b2fe45d5c48b582ec9b8c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/cc09d55f519e15355de343264a22ac6682b8305e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e0ce3da82341fcd6194175f1837946b2a894c625

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.