CVE-2026-46283: tpm: Use kfree_sensitive() to free auth session in tpm_dev_release()
In the Linux kernel, the following vulnerability has been resolved:
tpm: Use kfreesensitive() to free auth session in tpmdevrelease()
tpmdevrelease() uses plain kfree() to free chip->auth, which contains sensitive cryptographic material including HMAC session keys, nonces, and passphrase data (struct tpm2auth).
Every other code path that frees this structure uses kfreesensitive() to zero the memory before releasing it: both tpm2endauthsession() and tpmbufcheckhmacresponse() do so. The tpmdevrelease() path is the only one that does not, leaving key material in freed slab memory until it is eventually overwritten.
Use kfreesensitive() for consistency with the rest of the driver and to ensure session keys are scrubbed during device teardown.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In tpm_dev_release(), replace the plain kfree() used to free chip->auth (struct tpm2_auth) with kfree_sensitive() so sensitive cryptographic material (e.g., HMAC session keys and nonces) is scrubbed during device teardown; ensure tpm2_end_auth_session() and tpm_buf_check_hmac_response() use kfree_sensitive() consistently.
Linux kernel TPM driver Use kfree_sensitive() instead of kfree() for freeing auth session/passphrase data = kfree_sensitive()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46283?
CVE-2026-46283 has a risk rating of 26, indicating a significant security vulnerability.
How do I fix CVE-2026-46283?
To fix CVE-2026-46283, update the Linux kernel to the latest stable version that addresses this vulnerability.
What are the potential impacts of exploiting CVE-2026-46283?
Exploiting CVE-2026-46283 could lead to unauthorized access to sensitive cryptographic material.
Which versions of the Linux kernel are affected by CVE-2026-46283?
CVE-2026-46283 affects certain versions of the Linux kernel prior to the fix implemented in the latest updates.
Is there a workaround for CVE-2026-46283?
Currently, the best course of action for CVE-2026-46283 is to apply the available patch or update the kernel.