CVE-2026-45871: Linux Kernel TPM Cleanup Vulnerability

CVE-2026-45871 Overview

CVE-2026-45871 is a Linux kernel vulnerability in the st33zp24 Trusted Platform Module (TPM) driver. The flaw resides in the st33zp24_send() function, where the driver fails to release an acquired TPM locality when get_burstcount() returns -EBUSY on timeout. This missing cleanup path leaves the TPM locality held after an error condition, leading to resource state corruption.

The issue affects systems using the STMicroelectronics ST33ZP24 TPM chip via the kernel TPM subsystem. While not remotely exploitable, the defect can cause TPM service disruption on affected hardware.

Critical Impact
A timeout in get_burstcount() causes st33zp24_send() to return without releasing the TPM locality, resulting in resource leaks and potential denial of service for TPM-dependent operations.

Affected Products

Linux kernel branches containing the drivers/char/tpm/st33zp24 driver prior to the fix
Systems using STMicroelectronics ST33ZP24 TPM hardware
Stable kernel trees referenced in the upstream fix commits

Discovery Timeline

2026-05-27 - CVE-2026-45871 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45871

Vulnerability Analysis

The vulnerability affects the st33zp24_send() function within the Linux kernel TPM driver for the ST33ZP24 chip. This function transmits commands to the TPM and must coordinate access through the TPM locality mechanism. Before sending data, the driver requests a locality, then queries get_burstcount() to determine how many bytes the TPM can accept at a time.

When get_burstcount() times out, it returns -EBUSY. In the unpatched code, st33zp24_send() propagates this error directly to the caller without traversing the cleanup path. The previously acquired locality is never released, leaving the TPM in an inconsistent state.

Repeated occurrences can starve subsequent TPM requests and degrade availability of TPM-backed services such as measured boot, disk encryption key sealing, and remote attestation.

Root Cause

The root cause is missing error-path cleanup. The function returned directly from the error condition instead of jumping to the out_err label, which performs locality release. This is a classic resource management defect in kernel driver code.

Attack Vector

Exploitation requires local conditions on a system with the affected TPM hardware. An unprivileged process or a fault condition that induces TPM bus contention can trigger the -EBUSY return from get_burstcount(). The vulnerability does not enable code execution or privilege escalation; the impact is limited to denial of service against TPM functionality.

The upstream patch replaces the direct return with goto out_err, ensuring the locality is released on every failure path. See the Kernel Git Commit #ec15eb6 for the corrected control flow.

Detection Methods for CVE-2026-45871

Indicators of Compromise

Repeated -EBUSY errors from the st33zp24 driver in kernel logs (dmesg)
TPM operations failing with locality acquisition errors after prior timeouts
TPM-dependent services such as tpm2-abrmd reporting persistent unavailability

Detection Strategies

Audit kernel version strings against the fixed stable releases referenced in the upstream commits
Monitor kernel ring buffer for messages originating from drivers/char/tpm/st33zp24/
Correlate TPM service failures with get_burstcount timeout conditions in system telemetry

Monitoring Recommendations

Forward kernel logs to a centralized log aggregation platform and alert on TPM driver errors
Track /sys/class/tpm/tpm0/ interface availability and timing of TPM command failures
Inventory hosts using ST33ZP24 hardware to scope exposure across the fleet

How to Mitigate CVE-2026-45871

Immediate Actions Required

Apply the stable kernel update containing the fix from your Linux distribution vendor
Identify hosts using the ST33ZP24 TPM and prioritize them for patching
Restart TPM-dependent services after kernel updates to clear any latent locality state

Patch Information

The fix introduces a goto out_err in st33zp24_send() so that the locality acquired before calling get_burstcount() is released on the -EBUSY error path. The patch was applied across multiple stable trees. Relevant commits include Kernel Git Commit #ec15eb6, Kernel Git Commit #1256c6d, Kernel Git Commit #3e91b44, Kernel Git Commit #4fffb77, Kernel Git Commit #7687133, Kernel Git Commit #a51cff9, Kernel Git Commit #cc09d55, and Kernel Git Commit #e0ce3da.

Workarounds

Unload the st33zp24 module on systems where TPM functionality is not required
Reduce contention on the TPM bus by limiting concurrent TPM-using services until patches are applied
Reboot affected systems to clear stuck locality state if TPM operations begin failing

bash

# Verify kernel version and check whether the st33zp24 driver is loaded
uname -r
lsmod | grep st33zp24

# Inspect kernel log for related TPM errors
dmesg | grep -i -E 'tpm|st33zp24'

# Apply distribution kernel update (example for Debian/Ubuntu)
sudo apt update && sudo apt upgrade linux-image-$(uname -r)
sudo reboot