All vulnerabilities
CVE-2026-98221

Linux: KEYS: trusted: Fix tpm2_load_cmd() boundary check

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3fd487c69ad3161e358c33c170bab0cf02a071b7Also 5afa57ea91481c6c49f194b0f5a5c4d96a4d7348, 9ddbc5f4bb498aff8096a5231574858a4bffee4f and 2 moreCVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 3fd487c69ad3161e358c33c170bab0cf02a071b7LinuxCVE List
  • 5afa57ea91481c6c49f194b0f5a5c4d96a4d7348LinuxCVE List
  • 9ddbc5f4bb498aff8096a5231574858a4bffee4fLinuxCVE List
  • 134825dfc971fbf2b1d0f58f0b3bce8332ad0afbLinuxCVE List
  • 114f00d738f15dd8c7318369edcdc53dd6d08763LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

KEYS: trusted: Fix tpm2_load_cmd() boundary check

tpm2_load_cmd() does boundary checks against the ASN.1 size i.e., payload->blob_len. Address this by passing the decoded blob size to tpm2_load_cmd(), and use it for the boundary checks.

Text from CVE List

Affected versions 16

  • Linuxaffected: f2219745250f388edacabe6cca73654131c67d0a before cc86227fea28aed86c1fb52a884560b4440da198CVE List
  • Linuxaffected: f2219745250f388edacabe6cca73654131c67d0a before b020b447338872440142fe8a57350a483da86b7aCVE List
  • Linuxaffected: f2219745250f388edacabe6cca73654131c67d0a before 3fd487c69ad3161e358c33c170bab0cf02a071b7CVE List
  • Linuxaffected: f2219745250f388edacabe6cca73654131c67d0a before 5afa57ea91481c6c49f194b0f5a5c4d96a4d7348CVE List
  • Linuxaffected: f2219745250f388edacabe6cca73654131c67d0a before 9ddbc5f4bb498aff8096a5231574858a4bffee4fCVE List
  • Linuxaffected: f2219745250f388edacabe6cca73654131c67d0a before 134825dfc971fbf2b1d0f58f0b3bce8332ad0afbCVE List
  • Linuxaffected: f2219745250f388edacabe6cca73654131c67d0a before 114f00d738f15dd8c7318369edcdc53dd6d08763CVE List
  • Linuxaffected: 5.13CVE List
  • Linuxunaffected: all versions before 5.13CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 7