Linux kernel trusted keys: use-after-free when the trusted-key TPM backend is torn down

Impact

trusted_tpm_exit() drops the TPM chip reference and frees the digest array before unregistering the trusted key type, so an in-flight add_key() sealing operation can call tpm_pcr_extend() against a freed digest array, and the chip can be released while callbacks still use it. KASAN confirms a slab-use-after-free reachable from __do_sys_add_key(). On a GPU node this matters only where trusted keys are in use (TPM-sealed secrets, measured boot key material) and someone can unload the trusted module - unloading is root-only, and the race window is module removal, so most fleets are not exposed. The write primitive from a freed slab is the sort of thing that turns a local account into kernel compromise where the exposure does exist.

Who can reach it

Local user who can call add_key() for a trusted key concurrently with root (or an automated package/driver update) unloading the trusted key module. Not remotely reachable.

What to do

Take the stable-kernel fix that moves unregister_key_type() ahead of releasing the TPM chip and digest array (three stable commits linked in the record). Rolling it out means installing the patched kernel and rebooting each node, so it lands in a normal drain-and-reboot cycle rather than an emergency window. No fixed version numbers are given in the record beyond the commit ids.

References

Related entries

• Linux kernel virtio-gpu: unvalidated EDID block offset lets a malicious backend read past a kernel bufferCVE-2026-68255 · Linux kernel drm/virtio (virtio_get_edid_block response bounds)High
• Linux kernel (drivers/pci): The option-ROM parser trusts the header and data-structure offsets it reads out of theCVE-2026-72487 · Linux kernel (drivers/pci)High
• Xen qemu-xen-traditional device model hw/pt-msi.c (MSI-X passthrough): Buffer overflow on the MSI-X table write pathCVE-2015-8554 · Xen qemu-xen-traditional device model hw/pt-msi.c (MSI-X passthrough)High
• Linux kernel RDS net/rds/recv.c - rds_inc_info_copy: A structure member is left uninitialised before the RDS messageCVE-2016-5244 · Linux kernel RDS net/rds/recv.c - rds_inc_info_copyHigh
• QEMU (virtio-net): Heap use-after-free in virtio_net_receive_rcu - guest-to-host code execution in the QEMU processCVE-2021-3748 · QEMU (virtio-net)High
• Linux kernel (drivers/nvme/target): When the target's peer-to-peer memory pool runs dry, it still tries to return theCVE-2021-47130 · Linux kernel (drivers/nvme/target)High