CVE-2025-68792 (GCVE-0-2025-68792)

Vulnerability from cvelistv5 – Published: 2026-01-13 15:29 – Updated: 2026-08-05 12:11
VLAI
Title
tpm2-sessions: Fix out of range indexing in name_size
Summary
In the Linux kernel, the following vulnerability has been resolved: tpm2-sessions: Fix out of range indexing in name_size 'name_size' does not have any range checks, and it just directly indexes with TPM_ALG_ID, which could lead into memory corruption at worst. Address the issue by only processing known values and returning -EINVAL for unrecognized values. Make also 'tpm_buf_append_name' and 'tpm_buf_fill_hmac_session' fallible so that errors are detected before causing any spurious TPM traffic. End also the authorization session on failure in both of the functions, as the session state would be then by definition corrupted.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 1085b8276bb4239daa7008f0dcd5c973e4bd690f , < 47e676ce4d68f461dfcab906f6aeb254f7276deb (git)
Affected: 1085b8276bb4239daa7008f0dcd5c973e4bd690f , < 04a3aa6e8c5f878cc51a8a1c90b6d3c54079bc43 (git)
Affected: 1085b8276bb4239daa7008f0dcd5c973e4bd690f , < 6e9722e9a7bfe1bbad649937c811076acf86e1fd (git)
Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.12.66 , ≤ 6.12.* (semver)
Unaffected: 6.18.3 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/char/tpm/tpm2-cmd.c",
            "drivers/char/tpm/tpm2-sessions.c",
            "include/linux/tpm.h",
            "security/keys/trusted-keys/trusted_tpm2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "47e676ce4d68f461dfcab906f6aeb254f7276deb",
              "status": "affected",
              "version": "1085b8276bb4239daa7008f0dcd5c973e4bd690f",
              "versionType": "git"
            },
            {
              "lessThan": "04a3aa6e8c5f878cc51a8a1c90b6d3c54079bc43",
              "status": "affected",
              "version": "1085b8276bb4239daa7008f0dcd5c973e4bd690f",
              "versionType": "git"
            },
            {
              "lessThan": "6e9722e9a7bfe1bbad649937c811076acf86e1fd",
              "status": "affected",
              "version": "1085b8276bb4239daa7008f0dcd5c973e4bd690f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/char/tpm/tpm2-cmd.c",
            "drivers/char/tpm/tpm2-sessions.c",
            "include/linux/tpm.h",
            "security/keys/trusted-keys/trusted_tpm2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.66",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.3",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm2-sessions: Fix out of range indexing in name_size\n\n\u0027name_size\u0027 does not have any range checks, and it just directly indexes\nwith TPM_ALG_ID, which could lead into memory corruption at worst.\n\nAddress the issue by only processing known values and returning -EINVAL for\nunrecognized values.\n\nMake also \u0027tpm_buf_append_name\u0027 and \u0027tpm_buf_fill_hmac_session\u0027 fallible so\nthat errors are detected before causing any spurious TPM traffic.\n\nEnd also the authorization session on failure in both of the functions, as\nthe session state would be then by definition corrupted."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - An unprivileged process can reach the vulnerable parser through add_key trusted-key operations, which invoke TPM2_ReadPublic and session HMAC preparation; no physical access is required.\nAC:L - On an affected configuration with a compatible TPM or vTPM, the attacker controls the trusted-key creation and load sequence and can select an unsupported Name algorithm such as sm3-256 without a race or uncontrollable condition.\nPR:L - The add_key syscall and trusted-key instantiate path contain no capability check, and an ordinary user can target a writable user or process keyring.\nUI:N - Exploitation is initiated entirely by the attacker\u0027s syscalls and TPM command sequence without requiring another user to act.\nS:U - The vulnerable code and the affected kernel resources belong to the same host-kernel security authority; ordinary kernel privilege escalation does not change scope.\nC:H - The out-of-range table value becomes a length used for subsequent kernel-memory processing, enabling an out-of-bounds read and potential disclosure in the highest-severity reasonable layout.\nI:H - The attacker-influenced length reaches memcpy into the fixed-size authorization Name storage, permitting out-of-bounds writes and potentially exploitable kernel memory corruption.\nA:H - The invalid index and resulting out-of-bounds accesses can produce a kernel fault, KASAN panic, or corrupted session state, and the triggering operation can be repeated."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:11:28.554Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/47e676ce4d68f461dfcab906f6aeb254f7276deb"
        },
        {
          "url": "https://git.kernel.org/stable/c/04a3aa6e8c5f878cc51a8a1c90b6d3c54079bc43"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e9722e9a7bfe1bbad649937c811076acf86e1fd"
        }
      ],
      "title": "tpm2-sessions: Fix out of range indexing in name_size",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-68792",
    "datePublished": "2026-01-13T15:29:04.226Z",
    "dateReserved": "2025-12-24T10:30:51.037Z",
    "dateUpdated": "2026-08-05T12:11:28.554Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-68792",
      "date": "2026-08-15",
      "epss": "0.00132",
      "percentile": "0.03207"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-68792\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-01-13T16:16:01.090\",\"lastModified\":\"2026-07-30T06:24:44.653\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntpm2-sessions: Fix out of range indexing in name_size\\n\\n\u0027name_size\u0027 does not have any range checks, and it just directly indexes\\nwith TPM_ALG_ID, which could lead into memory corruption at worst.\\n\\nAddress the issue by only processing known values and returning -EINVAL for\\nunrecognized values.\\n\\nMake also \u0027tpm_buf_append_name\u0027 and \u0027tpm_buf_fill_hmac_session\u0027 fallible so\\nthat errors are detected before causing any spurious TPM traffic.\\n\\nEnd also the authorization session on failure in both of the functions, as\\nthe session state would be then by definition corrupted.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\ntpm2-sessions: Correcci\u00f3n de indexaci\u00f3n fuera de rango en name_size\\n\\n\u0027name_size\u0027 no tiene ninguna comprobaci\u00f3n de rango, y simplemente indexa directamente con TPM_ALG_ID, lo que podr\u00eda llevar a corrupci\u00f3n de memoria en el peor de los casos.\\n\\nAbordar el problema procesando solo valores conocidos y devolviendo -EINVAL para valores no reconocidos.\\n\\nHacer tambi\u00e9n \u0027tpm_buf_append_name\u0027 y \u0027tpm_buf_fill_hmac_session\u0027 falibles para que los errores sean detectados antes de causar cualquier tr\u00e1fico TPM espurio.\\n\\nFinalizar tambi\u00e9n la sesi\u00f3n de autorizaci\u00f3n en caso de fallo en ambas funciones, ya que el estado de la sesi\u00f3n estar\u00eda entonces por definici\u00f3n corrupto.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/char/tpm/tpm2-cmd.c\",\"drivers/char/tpm/tpm2-sessions.c\",\"include/linux/tpm.h\",\"security/keys/trusted-keys/trusted_tpm2.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1085b8276bb4239daa7008f0dcd5c973e4bd690f\",\"lessThan\":\"47e676ce4d68f461dfcab906f6aeb254f7276deb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1085b8276bb4239daa7008f0dcd5c973e4bd690f\",\"lessThan\":\"04a3aa6e8c5f878cc51a8a1c90b6d3c54079bc43\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1085b8276bb4239daa7008f0dcd5c973e4bd690f\",\"lessThan\":\"6e9722e9a7bfe1bbad649937c811076acf86e1fd\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/char/tpm/tpm2-cmd.c\",\"drivers/char/tpm/tpm2-sessions.c\",\"include/linux/tpm.h\",\"security/keys/trusted-keys/trusted_tpm2.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.66\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.3\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/04a3aa6e8c5f878cc51a8a1c90b6d3c54079bc43\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/47e676ce4d68f461dfcab906f6aeb254f7276deb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6e9722e9a7bfe1bbad649937c811076acf86e1fd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-14T18:51:09+00:00",
      "cve": "CVE-2025-68792",
      "id": "CVE-2025-68792",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "184",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tpm2-sessions: Fix out of range indexing in name_size",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68792.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-19T17:45:02Z",
      "cve": "CVE-2025-68792",
      "id": "CVE-2025-68792",
      "initial_release_date": "2026-01-15T00:26:16Z",
      "product_status:first_fixed": "2",
      "product_status:known_not_affected": "351",
      "product_status:recommended": "172",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-68792",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-68792.json",
      "version": "16"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.