UBUNTU-CVE-2026-72151: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: tpm: tpm2-sessions: wait for async KPP completion in tpmbufappendsalt tpmbufappendsalt() in drivers/char/tpm/tpm2-sessions.c calls cryptokppgeneratepublickey() and cryptokppcomputesharedsecret() without installing a completion callback, discards both return values, and immediately frees the kpprequest via kpprequestfree(). When the resolved ecdh-nist-p256 KPP backend is asynchronous (atmel-ecc, HPRE, keembay-ocs), either operation returns -EINPROGRESS and the deferred completion worker dereferences the freed request. The path fires automatically from the hwrngfillfn kernel thread via tpmgetrandom -> tpm2getrandom -> tpm2startauthsession -> tpmbufappendsalt on every entropy poll, without any userland action. Install cryptoreqdone as the completion callback, wrap both KPP operations in cryptowaitreq(), and propagate errors to the caller. The wait is a no-op for synchronous backends.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
Systems using an affected Ubuntu kernel package are exposed when TPM 2.0 authorization sessions use an ECDH NIST P-256 KPP backend that completes asynchronously. The described asynchronous backends are atmel-ecc, HPRE, and keembay-ocs; synchronous backends are not affected by the unsafe completion behavior.
Does exploitation require a local user or application to trigger a TPM operation?
No userland action is required. The vulnerable path can run automatically from the hwrng_fillfn kernel thread during entropy polling through TPM random-number retrieval and TPM 2.0 session setup.
What happens if the vulnerable asynchronous path is reached?
An asynchronous KPP operation can return -EINPROGRESS, after which its request is freed too early. The deferred completion worker can then dereference the freed request, causing a use-after-free condition in the kernel.
What is the practical mitigation if an updated kernel cannot be deployed immediately?
The provided data identifies the affected condition as use of an asynchronous ECDH NIST P-256 KPP backend with TPM 2.0 sessions. No specific configuration workaround or disabling procedure is provided.