All vulnerabilities
CVE-2026-98728

Linux: tpm: fix off-by-four bounds check in tpm2_get_random()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in42bb6216b861e892512128219ff23010d656ba14Also 9b522400bf5c082feb9a0037a053ea822a2c7e4dCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 42bb6216b861e892512128219ff23010d656ba14LinuxCVE List
  • 9b522400bf5c082feb9a0037a053ea822a2c7e4dLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

tpm: fix off-by-four bounds check in tpm2_get_random()

When the response carries the TPM2_ST_SESSIONS tag, tpm2_get_random() skips the 4-byte parameter size field before locating the random data, but the bounds check still validates the response length against TPM_HEADER_SIZE. A truncated response can pass the check and make memcpy() read up to 4 bytes past the response end, so stale buffer contents end up in the caller's random bytes.

Fix this by checking the response length against 'offset', which already includes the skipped parameter size field.

Text from CVE List

Affected versions 10

  • Linuxaffected: 1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497 before be54101992c2c5218be0e0a87827ccc96e3089afCVE List
  • Linuxaffected: 1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497 before e30a2406408d2df6d9cd48c2e59e913cf266a05aCVE List
  • Linuxaffected: 1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497 before 42bb6216b861e892512128219ff23010d656ba14CVE List
  • Linuxaffected: 1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497 before 9b522400bf5c082feb9a0037a053ea822a2c7e4dCVE List
  • Linuxaffected: 6.10CVE List
  • Linuxunaffected: all versions before 6.10CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4