CVE-2026-72151 (GCVE-0-2026-72151)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:53 – Updated: 2026-08-17 05:41
VLAI
Title
tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt
Summary
In the Linux kernel, the following vulnerability has been resolved: tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt tpm_buf_append_salt() in drivers/char/tpm/tpm2-sessions.c calls crypto_kpp_generate_public_key() and crypto_kpp_compute_shared_secret() without installing a completion callback, discards both return values, and immediately frees the kpp_request via kpp_request_free(). When the resolved ecdh-nist-p256 KPP backend is asynchronous (atmel-ecc, HPRE, keembay-ocs), either operation returns -EINPROGRESS and the deferred completion worker dereferences the freed request. The path fires automatically from the hwrng_fillfn kernel thread via tpm_get_random -> tpm2_get_random -> tpm2_start_auth_session -> tpm_buf_append_salt on every entropy poll, without any userland action. Install crypto_req_done as the completion callback, wrap both KPP operations in crypto_wait_req(), and propagate errors to the caller. The wait is a no-op for synchronous backends.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1085b8276bb4239daa7008f0dcd5c973e4bd690f , < 111e520efbe82b324bc42b1999b723c0619eea6d (git)
Affected: 1085b8276bb4239daa7008f0dcd5c973e4bd690f , < 934d1cd40e2893bf7a041b54f6afd1c008d7a21c (git)
Affected: 1085b8276bb4239daa7008f0dcd5c973e4bd690f , < 493333f167926c7adab8e7563e21ad71d8af84fa (git)
Affected: 1085b8276bb4239daa7008f0dcd5c973e4bd690f , < 73851a7c43dfa52d2ed9415889b33daf85da0ed9 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/char/tpm/tpm2-sessions.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "111e520efbe82b324bc42b1999b723c0619eea6d",
              "status": "affected",
              "version": "1085b8276bb4239daa7008f0dcd5c973e4bd690f",
              "versionType": "git"
            },
            {
              "lessThan": "934d1cd40e2893bf7a041b54f6afd1c008d7a21c",
              "status": "affected",
              "version": "1085b8276bb4239daa7008f0dcd5c973e4bd690f",
              "versionType": "git"
            },
            {
              "lessThan": "493333f167926c7adab8e7563e21ad71d8af84fa",
              "status": "affected",
              "version": "1085b8276bb4239daa7008f0dcd5c973e4bd690f",
              "versionType": "git"
            },
            {
              "lessThan": "73851a7c43dfa52d2ed9415889b33daf85da0ed9",
              "status": "affected",
              "version": "1085b8276bb4239daa7008f0dcd5c973e4bd690f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/char/tpm/tpm2-sessions.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt\n\ntpm_buf_append_salt() in drivers/char/tpm/tpm2-sessions.c calls\ncrypto_kpp_generate_public_key() and crypto_kpp_compute_shared_secret()\nwithout installing a completion callback, discards both return values,\nand immediately frees the kpp_request via kpp_request_free(). When the\nresolved ecdh-nist-p256 KPP backend is asynchronous (atmel-ecc, HPRE,\nkeembay-ocs), either operation returns -EINPROGRESS and the deferred\ncompletion worker dereferences the freed request.\n\nThe path fires automatically from the hwrng_fillfn kernel thread via\ntpm_get_random -\u003e tpm2_get_random -\u003e tpm2_start_auth_session -\u003e\ntpm_buf_append_salt on every entropy poll, without any userland action.\n\nInstall crypto_req_done as the completion callback, wrap both KPP\noperations in crypto_wait_req(), and propagate errors to the caller.\nThe wait is a no-op for synchronous backends."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only via local kernel TPM/HWRNG paths (hwrng_fillfn kernel thread polling tpm_get_random, or local /dev/hwrng reads); there is no network, adjacent-radio, or physical-access entry point to tpm_buf_append_salt.\nAC:L - On affected builds (CONFIG_TCG_TPM2_HMAC plus an async ecdh-nist-p256 backend), the UAF is deterministically triggered each auth-session setup without winning a race; async KPP returns -EINPROGRESS and the completion worker later dereferences the already-freed kpp_request.\nPR:N - No attacker credentials are required: the hwrng kernel thread invokes tpm2_start_auth_session automatically on TPM RNG polls, and unprivileged local processes can also reach tpm_get_random via /dev/hwrng without root or namespaced admin capabilities.\nUI:N - Exploitation does not require any victim user action such as mounting a filesystem or opening a file; the bug fires from background kernel entropy collection and TPM session setup without interactive steps.\nS:U - Impact is confined to kernel memory integrity and availability on the same host; it is a standard kernel heap UAF, not a cross-boundary escape such as guest-to-host VM breakout or IOMMU/DMA bypass.\nC:H - Use-after-free of a kmalloc\u0027d kpp_request lets an attacker influence freed heap contents and potentially obtain arbitrary kernel memory read primitives through heap grooming, not merely a bounded leak.\nI:H - The UAF corrupts kernel heap metadata/object lifetimes and can be leveraged for arbitrary write or control-flow hijack (privilege escalation), not just limited or transient data modification.\nA:H - The deferred crypto completion dereferences freed memory, causing kernel oops/panic or hang during normal TPM RNG polling, yielding complete loss of system availability on affected hardware."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:41:00.459Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/111e520efbe82b324bc42b1999b723c0619eea6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/934d1cd40e2893bf7a041b54f6afd1c008d7a21c"
        },
        {
          "url": "https://git.kernel.org/stable/c/493333f167926c7adab8e7563e21ad71d8af84fa"
        },
        {
          "url": "https://git.kernel.org/stable/c/73851a7c43dfa52d2ed9415889b33daf85da0ed9"
        }
      ],
      "title": "tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72151",
    "datePublished": "2026-08-15T05:53:22.196Z",
    "dateReserved": "2026-08-09T03:40:39.908Z",
    "dateUpdated": "2026-08-17T05:41:00.459Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72151",
      "date": "2026-09-21",
      "epss": "0.00182",
      "percentile": "0.08057"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/char/tpm/tpm2-sessions.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "111e520efbe82b324bc42b1999b723c0619eea6d",
                    "status": "affected",
                    "version": "1085b8276bb4239daa7008f0dcd5c973e4bd690f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "934d1cd40e2893bf7a041b54f6afd1c008d7a21c",
                    "status": "affected",
                    "version": "1085b8276bb4239daa7008f0dcd5c973e4bd690f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "493333f167926c7adab8e7563e21ad71d8af84fa",
                    "status": "affected",
                    "version": "1085b8276bb4239daa7008f0dcd5c973e4bd690f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "73851a7c43dfa52d2ed9415889b33daf85da0ed9",
                    "status": "affected",
                    "version": "1085b8276bb4239daa7008f0dcd5c973e4bd690f",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/char/tpm/tpm2-sessions.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.10"
                  },
                  {
                    "lessThan": "6.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt\n\ntpm_buf_append_salt() in drivers/char/tpm/tpm2-sessions.c calls\ncrypto_kpp_generate_public_key() and crypto_kpp_compute_shared_secret()\nwithout installing a completion callback, discards both return values,\nand immediately frees the kpp_request via kpp_request_free(). When the\nresolved ecdh-nist-p256 KPP backend is asynchronous (atmel-ecc, HPRE,\nkeembay-ocs), either operation returns -EINPROGRESS and the deferred\ncompletion worker dereferences the freed request.\n\nThe path fires automatically from the hwrng_fillfn kernel thread via\ntpm_get_random -\u003e tpm2_get_random -\u003e tpm2_start_auth_session -\u003e\ntpm_buf_append_salt on every entropy poll, without any userland action.\n\nInstall crypto_req_done as the completion callback, wrap both KPP\noperations in crypto_wait_req(), and propagate errors to the caller.\nThe wait is a no-op for synchronous backends."
          }
        ],
        "id": "CVE-2026-72151",
        "lastModified": "2026-08-17T06:18:15.263",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:21:32.823",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/111e520efbe82b324bc42b1999b723c0619eea6d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/493333f167926c7adab8e7563e21ad71d8af84fa"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/73851a7c43dfa52d2ed9415889b33daf85da0ed9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/934d1cd40e2893bf7a041b54f6afd1c008d7a21c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T13:34:42+00:00",
      "cve": "CVE-2026-72151",
      "id": "CVE-2026-72151",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72151.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T13:30:02Z",
      "cve": "CVE-2026-72151",
      "id": "CVE-2026-72151",
      "initial_release_date": "2026-08-31T13:30:02Z",
      "product_status:known_not_affected": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72151",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72151.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.