CVE-2026-98728: tpm: fix off-by-four bounds check in tpm2_get_random()
In the Linux kernel, the following vulnerability has been resolved:
tpm: fix off-by-four bounds check in tpm2getrandom()
When the response carries the TPM2STSESSIONS tag, tpm2getrandom() skips the 4-byte parameter size field before locating the random data, but the bounds check still validates the response length against TPMHEADERSIZE. A truncated response can pass the check and make memcpy() read up to 4 bytes past the response end, so stale buffer contents end up in the caller's random bytes.
Fix this by checking the response length against 'offset', which already includes the skipped parameter size field.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In tpm2_get_random(), check the response length against 'offset' rather than TPM_HEADER_SIZE, since 'offset' includes the skipped 4-byte parameter size field.
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems using the Linux kernel TPM 2.0 random-data path are exposed when a TPM response with the TPM2_ST_SESSIONS tag is processed. The issue concerns truncated TPM responses handled by tpm2_get_random().
What does an attacker need to do to trigger the issue?
An attacker would need to cause the kernel to process a truncated TPM response carrying the TPM2_ST_SESSIONS tag. The insufficient length validation can then allow memcpy() to read up to four bytes beyond the response end.
What is the impact of successful exploitation?
Up to four bytes of stale buffer contents can be included in the random bytes returned to the caller. The provided information describes an out-of-bounds read, not a kernel crash or code execution.
How can I tell whether a system is affected?
The issue is fixed by changing the response-length check in tpm2_get_random() to validate against the offset that includes the skipped four-byte parameter-size field. Check whether the installed kernel includes one of the referenced stable commits or an equivalent fix.