PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46283 Linux CVE debrief

CVE-2026-46283 is an information disclosure vulnerability in the Linux kernel. The tpm_dev_release() function uses kfree() to free sensitive data, potentially leaving sensitive cryptographic material in freed slab memory. This issue has been resolved by using kfree_sensitive() to ensure session keys are scrubbed during device teardown.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-07-23
Advisory published
2026-06-08
Advisory updated
2026-07-23

Who should care

Linux kernel developers and users, especially those using TPM (Trusted Platform Module) functionality.

Technical summary

The tpm_dev_release() function in the Linux kernel was using kfree() to free sensitive data, including HMAC session keys, nonces, and passphrase data. This could leave sensitive information in freed slab memory until it is eventually overwritten. The issue has been fixed by replacing kfree() with kfree_sensitive() to ensure that sensitive data is properly scrubbed during device teardown.

Defensive priority

Medium

Recommended defensive actions

  • Apply the patch from the Linux kernel repository to update the tpm_dev_release() function to use kfree_sensitive().
  • Use a Linux kernel version that includes the fix for CVE-2026-46283.

Evidence notes

The CVE record and NVD detail for CVE-2026-46283 provide information on the vulnerability and its resolution.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46283 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46283

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46283 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46283

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/53e6d2d834df40960b655b353e7a8ff4d927e1c7

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/84ced03172da544c9f8c0862faad48104f519352

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c424d2664f08c77f08b4580b5f0cbaabf7c229b2

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/dd3ac52ea7a001406c7dbc663aae4b9f89da679a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.