CVE-2026-90070: Linux Linux kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved:
tpm: st33zp24: Return zero on status read failure
st33zp24status() ignores the result of the transport read and returns data even when no byte was received. The I2C transport, for example, skips i2cmasterrecv() when the register-select write is short or fails, leaving data uninitialized. The resulting stack value can be interpreted as TPMSTS flags and let status checks complete spuriously.
The status callback cannot propagate a transport error. Return zero unless recv() reports exactly one byte. With no status bits set, callers retry or take their existing timeout or error path instead of acting on an invalid status value.
This issue was found by a static analysis checker and confirmed by manual source review.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the st33zp24 TPM driver are affected when a transport status read fails or returns fewer than one byte. The described I2C path is affected when the register-select write is short or fails, causing the receive operation to be skipped.
What condition causes the incorrect status handling?
The issue occurs when the transport read does not report exactly one byte but the driver still uses the status-data value. In the I2C case, this can leave the status byte uninitialized and allow it to be interpreted as TPM_STS flags.
What is the effect of the resolved behavior?
The corrected driver returns zero unless the receive operation reports exactly one byte. This prevents invalid status data from satisfying status checks, so callers instead retry or follow their existing timeout or error path.