CVE-2026-46096: tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public()
In the Linux kernel, the following vulnerability has been resolved:
tpm2-sessions: Fix missing tpmbufdestroy() in tpm2readpublic()
tpm2readpublic() calls tpmbufinit() but fails to call tpmbufdestroy() on two exit paths, leaking a page allocation:
1. When namesize() returns an error (unrecognized hash algorithm), the function returns directly without destroying the buffer.
2. On the success path, the buffer is never destroyed before returning.
All other error paths in the function correctly call tpmbufdestroy() before returning.
Fix both by adding the missing tpmbufdestroy() calls.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In tpm2_read_public(), add the missing tpm_buf_destroy() calls so the buffer allocated by tpm_buf_init() is destroyed both when name_size() returns an error (unrecognized hash algorithm) and on the other missing exit path; this resolves a page leak from not destroying the buffer before returning.
Linux kernel (tpm2-sessions) tpm_buf_destroy() calls = Ensure tpm_buf_destroy() is invoked on the error paths and the direct-return path in tpm2_read_public() (after tpm_buf_init())
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46096?
The severity of CVE-2026-46096 is rated as 6.
How do I fix CVE-2026-46096?
To fix CVE-2026-46096, update to the latest version of the Linux kernel where the vulnerability has been patched.
What causes CVE-2026-46096 in the Linux kernel?
CVE-2026-46096 is caused by a failure to call tpm_buf_destroy() in tpm2_read_public(), leading to a page allocation leak.
Which functions are involved in CVE-2026-46096?
CVE-2026-46096 involves the functions tpm_buf_init() and tpm_buf_destroy() in the context of tpm2_read_public().
What is the impact of CVE-2026-46096?
The impact of CVE-2026-46096 is a memory leak that could affect system performance over time if not addressed.