CVE-2026-45941: Linux Kernel TPM Privilege Escalation

CVE-2026-45941 Overview

CVE-2026-45941 is a resource management flaw in the Linux kernel's tpm_i2c_infineon driver. The tpm_tis_i2c_send() function acquires a TPM locality at the start of the send operation. When get_burstcount() returns -EBUSY on timeout, the function returns directly without releasing the acquired locality. This results in a locality leak that can leave the Trusted Platform Module (TPM) in an inconsistent state. The upstream fix replaces the direct return path with a goto out_err branch to ensure proper cleanup. The vulnerability affects systems using Infineon I2C TPM chips managed by the Linux kernel TPM subsystem.

Critical Impact
A leaked TPM locality can block subsequent TPM operations, degrade attestation and key-handling workflows, and create a denial-of-service condition on affected platforms.

Affected Products

Linux kernel tpm_i2c_infineon driver in the TPM subsystem
Systems using Infineon I2C-based TPM chips
Multiple stable Linux kernel branches receiving the backported fix

Discovery Timeline

2026-05-27 - CVE-2026-45941 published to the National Vulnerability Database (NVD)
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45941

Vulnerability Analysis

The defect resides in tpm_tis_i2c_send() within the tpm_i2c_infineon driver. The function first acquires a TPM locality, which is a hardware-level access scope that must be explicitly released after use. The send routine then calls get_burstcount() to determine how many bytes the TPM is ready to accept on the I2C bus.

The get_burstcount() helper can return -EBUSY when the TPM does not respond within the expected timeout window. In the vulnerable code path, the caller propagates this error by returning immediately. The locality acquired earlier is never released, leaving the TPM owned by a context that no longer exists in software.

Subsequent attempts to use the TPM may stall or fail because the locality remains held. Over time, repeated send failures can render the TPM effectively unusable until the system is reset. This is a kernel-mode resource leak rather than a memory-safety defect.

Root Cause

The root cause is missing cleanup on an error path. The function lacked a unified exit point that releases the locality, so an error return inserted into the middle of the function bypassed the release call. The fix routes the -EBUSY failure through goto out_err, matching the cleanup pattern used by other error branches in the same function.

Attack Vector

Triggering the leak requires conditions that cause get_burstcount() to time out, typically transient I2C bus contention, TPM firmware delays, or hardware-level disturbances. A local actor able to repeatedly invoke TPM send operations under stressed bus conditions could amplify the leak into a denial-of-service against TPM-dependent services such as measured boot, disk encryption key release, and remote attestation.

No verified proof-of-concept exploit is available. The vulnerability mechanism is documented in the upstream commits referenced by the Linux kernel stable tree.

Detection Methods for CVE-2026-45941

Indicators of Compromise

Repeated kernel log entries from the tpm_i2c_infineon driver indicating -EBUSY returns from get_burstcount()
TPM operations stalling or failing after transient I2C timeouts
Userspace services such as tpm2-abrmd, clevis, or measured-boot tooling reporting locality contention errors

Detection Strategies

Inventory Linux hosts running kernels prior to the fixed stable releases and identify those using Infineon I2C TPM hardware
Monitor dmesg and journal entries for repeated TPM send failures correlated with attestation or disk-unlock errors
Compare running kernel versions against the patched commits listed in the kernel.org references for each maintained branch

Monitoring Recommendations

Forward kernel and TPM subsystem logs to a centralized logging or SIEM platform for correlation
Alert on sustained TPM failure rates that could indicate the locality leak has occurred
Track patch deployment status across fleets, particularly on embedded and IoT systems where Infineon I2C TPMs are common

How to Mitigate CVE-2026-45941

Immediate Actions Required

Identify all Linux systems using the tpm_i2c_infineon driver by checking loaded modules and hardware inventory
Schedule kernel updates to a stable release that includes the upstream cleanup fix
Restart affected systems after patching to clear any TPM locality state left in an inconsistent condition

Patch Information

The fix is committed across multiple stable Linux kernel branches. Apply the kernel update corresponding to your distribution. Reference commits include 1a22048, 1bb8f88, 2f7a665, 8f124c5, 948966e, a61b841, bbd6e97, and c24c9c4.

Workarounds

No supported software workaround eliminates the locality leak without the kernel patch
Reduce exposure by limiting local code execution and restricting access to TPM device nodes such as /dev/tpm0 and /dev/tpmrm0
Reboot affected hosts if TPM operations begin failing to reset the locality state until patches are deployed

bash

# Verify kernel version and TPM driver state
uname -r
lsmod | grep tpm_i2c_infineon
dmesg | grep -i tpm