UBUNTU-CVE-2026-89763: Use After Free

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trustedtpmexit() drops the TPM chip reference and frees the digest array before unregistering the trusted key type. keytypelookup() holds keytypessem for reading until the key operation finishes, while unregisterkeytype() takes it for writing. It therefore provides the synchronization point that must precede backend teardown. The current order permits this interleaving: CPU 0 CPU 1 trustedtpmexit() keytypelookup("trusted") putdevice(&chip->dev) trustedtpmseal() kfree(digests) pcrlock() unregisterkeytype() tpmpcrextend(..., digests) CPU 1 can consequently dereference the freed digest array. The chip can also be released before callbacks stop using it. KASAN reported: BUG: KASAN: slab-use-after-free in tpmpcrextend+0x1f0/0x200 Read of size 2 at addr ffff88810872d000 by task poc/89 Call Trace: tpmpcrextend+0x1f0/0x200 pcrlock+0x42/0x70 [trusted] trustedtpmseal+0x1b6/0x570 [trusted] trustedinstantiate+0x293/0x340 [trusted] keyinstantiateandlink+0xb2/0x2b0 keycreateorupdate+0x61e/0xb50 dosysaddkey+0x1b8/0x310 Allocated by task 88: kmallocnoprof+0x1a7/0x490 dooneinitcall+0xa1/0x390 doinitmodule+0x2df/0x840 Freed by task 90: kfree+0x131/0x3c0 trustedtpmexit+0x59/0xa0 [trusted] dosysdeletemodule+0x346/0x510 Move unregisterkeytype() before releasing either resource. This stops new lookups and waits for in-flight key operations to finish before the backend state is destroyed.