« Volver al listado

CVE-2026-46096

Estado: AnalizadaMedia (5.5)—

In the Linux kernel, the following vulnerability has been resolved:

tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public()

tpm2_read_public() calls tpm_buf_init() but fails to call tpm_buf_destroy() on two exit paths, leaking a page allocation:

All other error paths in the function correctly call tpm_buf_destroy() before returning.

Fix both by adding the missing tpm_buf_destroy() calls.

Detalles técnicos trazas, registros y código del informe original
1. When name_size() returns an error (unrecognized hash algorithm),
   the function returns directly without destroying the buffer.

2. On the success path, the buffer is never destroyed before
   returning.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-46096",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "20eda7c74b69fe9e1caf9b930a5c016bf8d755fa",
              "lessThan": "f8775d9d9062da662cc861f9ff7722a65896d4cd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "bda1cbf73c6e241267c286427f2ed52b5735d872",
              "lessThan": "2f434be87e256fd58254f60ddf5d7d58e775ca0b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "bda1cbf73c6e241267c286427f2ed52b5735d872",
              "lessThan": "f0f75a3d98b7959a8677b6363e23190f3018636b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a3b7eb67225c486a2da357c5db3e386f4e64bcde",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "6.18.3",
              "lessThan": "6.18.27",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.12.64",
              "lessThan": "6.13",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "drivers/char/tpm/tpm2-sessions.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.19",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.0.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.*"
            },
            {
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/char/tpm/tpm2-sessions.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-05-27T14:17:31.220",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/2f434be87e256fd58254f60ddf5d7d58e775ca0b",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f0f75a3d98b7959a8677b6363e23190f3018636b",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f8775d9d9062da662cc861f9ff7722a65896d4cd",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public()\n\ntpm2_read_public() calls tpm_buf_init() but fails to call\ntpm_buf_destroy() on two exit paths, leaking a page allocation:\n\n1. When name_size() returns an error (unrecognized hash algorithm),\n   the function returns directly without destroying the buffer.\n\n2. On the success path, the buffer is never destroyed before\n   returning.\n\nAll other error paths in the function correctly call\ntpm_buf_destroy() before returning.\n\nFix both by adding the missing tpm_buf_destroy() calls."
    }
  ],
  "lastModified": "2026-06-25T21:17:06.863",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "87DC3D61-429B-4C73-A249-C5E443A6FFE1",
              "versionEndExcluding": "6.13",
              "versionStartIncluding": "6.12.64"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "93C4FAEA-8BA5-46B6-A5B5-4995751F206E",
              "versionEndExcluding": "6.18.27",
              "versionStartIncluding": "6.18.3"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CDB78D6D-22C3-4154-B0D0-94AF1CE5C2E3",
              "versionEndExcluding": "7.0.4",
              "versionStartIncluding": "6.19"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}