PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46096 Linux CVE debrief

A memory leak vulnerability exists in the Linux kernel's TPM2 (Trusted Platform Module 2.0) session handling code. The function `tpm2_read_public()` in the `tpm2-sessions` subsystem allocates a buffer via `tpm_buf_init()` but fails to release it on two specific code paths: (1) when `name_size()` returns an error due to an unrecognized hash algorithm, and (2) on the success path. This results in a page allocation leak. The vulnerability was resolved by adding the missing `tpm_buf_destroy()` calls to both exit paths. The fix has been committed to the stable Linux kernel tree.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Linux system administrators running kernels with TPM2 support enabled; security teams managing infrastructure with hardware security modules; kernel maintainers backporting stable patches

Technical summary

The vulnerability is a resource leak in `drivers/char/tpm/tpm2-sessions.c`. The `tpm2_read_public()` function initializes a `tpm_buf` structure using `tpm_buf_init()`, which performs a page allocation. The function correctly calls `tpm_buf_destroy()` on most error paths, but omits this cleanup: (1) when `name_size()` fails with an unrecognized hash algorithm error, returning directly; and (2) on the success return path. The fix adds `tpm_buf_destroy(&buf)` before both return statements. This is a local denial-of-service vector via memory exhaustion, requiring ability to trigger TPM2 operations.

Defensive priority

medium

Recommended defensive actions

  • Review kernel version and confirm application of stable kernel patches referencing the fixed commits
  • Monitor NVD for CVSS scoring once analysis is complete
  • If running systems with TPM2 enabled, prioritize kernel updates to prevent memory exhaustion under sustained TPM operations
  • Audit systems for unusual memory consumption patterns in kernel space that may indicate exploitation of this leak

Evidence notes

The vulnerability description is sourced from the official CVE record published by NVD on 2026-05-27. The fix is confirmed through three kernel.org git commits to the stable tree. No CVSS score has been assigned as of the CVE publication date; NVD status is 'Awaiting Analysis'. Vendor identification is marked low confidence ('Unknown Vendor') in source data, though the affected component is clearly the Linux kernel TPM subsystem.

Official resources

2026-05-27