Linux kernel trusted keys: use-after-free when the trusted-key TPM backend is torn down

Impact

trusted_tpm_exit() drops the TPM chip reference and frees the digest array before unregistering the trusted key type, so an in-flight add_key() sealing operation can call tpm_pcr_extend() against a freed digest array, and the chip can be released while callbacks still use it. KASAN confirms a slab-use-after-free reachable from __do_sys_add_key(). On a GPU node this matters only where trusted keys are in use (TPM-sealed secrets, measured boot key material) and someone can unload the trusted module - unloading is root-only, and the race window is module removal, so most fleets are not exposed. The write primitive from a freed slab is the sort of thing that turns a local account into kernel compromise where the exposure does exist.

Who can reach it

Local user who can call add_key() for a trusted key concurrently with root (or an automated package/driver update) unloading the trusted key module. Not remotely reachable.

What to do

Take the stable-kernel fix that moves unregister_key_type() ahead of releasing the TPM chip and digest array (three stable commits linked in the record). Rolling it out means installing the patched kernel and rebooting each node, so it lands in a normal drain-and-reboot cycle rather than an emergency window. No fixed version numbers are given in the record beyond the commit ids.

References

Related entries

• Linux kernel perf: use-after-free when an mmap revival races the last munmap, giving local rootCVE-2026-89791 · Linux kernel perf subsystem (perf_mmap_close / ring-buffer revival race)High
• Linux kernel BPF: bpf_get_stackid runs get_perf_callchain preemptible, exposing its trace bufferCVE-2026-89799 · Linux kernel BPF (bpf_get_stackid, get_perf_callchain preemption)High
• Linux kernel qla2xxx: use-after-free reading 84xx_fw_version during Fibre Channel HBA teardownCVE-2026-89854 · Linux kernel scsi qla2xxx (cs84xx chip release vs. 84xx_fw_version sysfs read)High
• Linux kernel mm/migrate_device: compound folio at the end of a range writes past the PFN arrayCVE-2026-89967 · Linux kernel mm/migrate_device (device-private page migration)High
• Linux kernel mm/mempolicy: weighted-interleave bulk allocation sleeps in atomic contextCVE-2026-89986 · Linux kernel mm/mempolicy (alloc_pages_bulk_weighted_interleave GFP flags)High
• Linux kernel megaraid_sas: NVMe PRP list overruns the chain frame and corrupts other in-flight commandsCVE-2026-90008 · Linux kernel megaraid_sas (NVMe PRP chain frame)High