CVE-2025-68792: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-68792 Overview

CVE-2025-68792 is a Linux kernel vulnerability in the TPM2 (Trusted Platform Module 2.0) sessions subsystem. The flaw resides in the handling of the name_size value within tpm2-sessions, which directly indexes an array using TPM_ALG_ID without performing any range checks. An attacker-influenced or malformed algorithm identifier can cause out-of-bounds memory access, potentially leading to memory corruption. The issue was resolved by validating known values, returning -EINVAL for unrecognized inputs, and making tpm_buf_append_name and tpm_buf_fill_hmac_session fallible so errors are caught before generating spurious TPM traffic. The patch also ends the authorization session on failure to prevent corrupted session state.

Critical Impact
Out-of-bounds array indexing in the Linux kernel TPM2 sessions code can corrupt memory and destabilize the authorization session state.

Affected Products

Linux kernel (TPM2 sessions subsystem, drivers/char/tpm/tpm2-sessions.c)
Distributions shipping affected stable kernel branches prior to the fix commits
Systems using TPM 2.0 with HMAC authorization sessions

Discovery Timeline

2026-01-13 - CVE-2025-68792 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-68792

Vulnerability Analysis

The vulnerability is an out-of-bounds read/write [CWE-125/CWE-787] in the Linux kernel's TPM2 sessions handler. The name_size variable is used to index a lookup table keyed by TPM_ALG_ID values without verifying that the supplied algorithm identifier falls within the expected range. Because TPM_ALG_ID is a 16-bit field that can carry arbitrary or unrecognized algorithm codes, the kernel reads or writes memory beyond the bounds of the intended structure.

The fix introduces explicit validation: only known algorithm identifiers are processed, and unrecognized values return -EINVAL. The helpers tpm_buf_append_name and tpm_buf_fill_hmac_session were converted to return error codes so callers detect failures before issuing TPM commands. On failure, the authorization session is explicitly terminated to prevent operations on a corrupted session.

Root Cause

The root cause is missing input validation on the algorithm identifier used as an array index. The code path assumed TPM_ALG_ID would always map to a valid entry, but no bounds check enforced that assumption. Any path delivering an unrecognized algorithm value through the TPM stack triggers undefined indexing behavior.

Attack Vector

Exploitation requires a code path that supplies an unexpected TPM_ALG_ID value into the TPM2 sessions logic. This typically requires local interaction with the kernel TPM interface or a malformed response from the TPM device itself. Successful triggering yields kernel memory corruption, which an attacker could chain toward privilege escalation or denial of service. The vulnerability is described in the upstream commits 04a3aa6, 47e676c, and 6e9722e.

No public proof-of-concept exists. See the upstream commits for the precise code paths and conditions.

Detection Methods for CVE-2025-68792

Indicators of Compromise

Unexpected kernel oops or BUG: messages referencing tpm2_sessions, tpm_buf_append_name, or tpm_buf_fill_hmac_session in dmesg
KASAN reports flagging out-of-bounds access in the TPM driver
TPM authorization sessions failing with -EINVAL after kernel updates, indicating the fix is rejecting malformed inputs

Detection Strategies

Audit installed kernel versions across Linux fleets and compare against the patched stable branches referenced in the upstream commits
Enable KASAN on test kernels to surface any residual out-of-bounds access in TPM code paths
Review kernel changelogs for backports of commits 04a3aa6, 47e676c, and 6e9722e

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on TPM subsystem crash signatures
Monitor for repeated TPM command failures or session termination events from system daemons such as tpm2-abrmd
Track package update compliance for kernel packages on TPM-equipped systems

How to Mitigate CVE-2025-68792

Immediate Actions Required

Apply the latest stable Linux kernel update from your distribution that includes the upstream fix commits
Inventory systems with TPM 2.0 hardware and prioritize them for kernel patching
Reboot patched systems to ensure the corrected kernel is loaded

Patch Information

The vulnerability is resolved by the upstream commits 04a3aa6, 47e676c, and 6e9722e. The fix restricts processing to recognized TPM_ALG_ID values, returns -EINVAL for unknown values, makes helper functions fallible, and ends the authorization session on failure.

Workarounds

No supported workaround exists short of patching; disabling TPM usage is not practical for systems relying on measured boot or disk encryption
Restrict local access to TPM device nodes (/dev/tpm0, /dev/tpmrm0) to trusted accounts via file permissions and udev rules
Where TPM functionality is not required, unloading the TPM kernel modules reduces exposure on affected hosts

bash

# Verify running kernel version and TPM device exposure
uname -r
ls -l /dev/tpm* /dev/tpmrm*

# Restrict TPM device access to the tss group
chown root:tss /dev/tpm0 /dev/tpmrm0
chmod 0660 /dev/tpm0 /dev/tpmrm0

# Confirm the patched kernel package is installed (Debian/Ubuntu example)
dpkg -l 'linux-image-*' | grep ^ii

# Confirm the patched kernel package is installed (RHEL/Fedora example)
rpm -q kernel