CVE-2026-46096: Linux Kernel Information Disclosure Flaw

CVE-2026-46096 Overview

CVE-2026-46096 is a memory leak vulnerability in the Linux kernel's Trusted Platform Module 2.0 (TPM2) sessions subsystem. The flaw resides in the tpm2_read_public() function, which calls tpm_buf_init() to allocate a buffer but fails to invoke tpm_buf_destroy() on two exit paths. Each missed cleanup leaks a page allocation. The issue affects kernels where the TPM2 session code path executes tpm2_read_public() against TPM-equipped systems. Kernel maintainers have committed fixes in the stable tree that add the missing tpm_buf_destroy() calls on both the error and success return paths.

Critical Impact
Each invocation of tpm2_read_public() leaks a full page of kernel memory, enabling gradual kernel memory exhaustion on systems that repeatedly read TPM public key data.

Affected Products

Linux kernel versions containing the unpatched tpm2_read_public() implementation in the TPM2 sessions code
Systems with TPM 2.0 hardware where userspace or kernel components invoke the affected path
Distributions shipping kernels prior to the stable backports referenced in the kernel.org commits

Discovery Timeline

2026-05-27 - CVE-2026-46096 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46096

Vulnerability Analysis

The vulnerability is a kernel memory leak [CWE-401] in the TPM2 sessions subsystem. The function tpm2_read_public() allocates a command buffer using tpm_buf_init(), which internally requests a page from the kernel allocator. The function is expected to release the buffer through tpm_buf_destroy() on every exit path. The unpatched code omits this call in two situations.

The first omission occurs when name_size() returns an error because the TPM reports an unrecognized hash algorithm. The function returns directly without freeing the buffer. The second omission occurs on the success path, where the buffer is never destroyed before the function returns to its caller. All remaining error paths in the function correctly release the buffer.

Repeated calls to the affected function leak one page of kernel memory per invocation. Over time this exhausts available memory and can degrade system stability or trigger out-of-memory conditions on long-running systems that interact with the TPM frequently.

Root Cause

The root cause is missing resource cleanup on selected control flow paths. The function does not pair every allocation with a corresponding tpm_buf_destroy() call. The fix adds the missing destruction calls so that the allocated page is released on both the success path and the name_size() error path.

Attack Vector

The vulnerability does not provide direct code execution or privilege escalation. The practical risk is resource exhaustion through repeated triggering of the leaking code path. Workloads or local processes that frequently read TPM public objects can accelerate exhaustion. The kernel commits referenced in the advisory contain the authoritative fix and may be reviewed at the Kernel Git commit, the stable update commit, and the follow-up change.

Detection Methods for CVE-2026-46096

Indicators of Compromise

Steady, unexplained growth in kernel slab or page allocator usage on systems with active TPM2 workloads
Increasing MemAvailable pressure correlated with TPM operations in /proc/meminfo
Out-of-memory killer events on long-running hosts that repeatedly read TPM public objects

Detection Strategies

Compare running kernel build identifiers against the fixed commits referenced on kernel.org to identify unpatched hosts
Monitor kernel memory counters such as Slab, KReclaimable, and total page allocations over extended uptime windows
Enable kmemleak on test kernels to confirm leaks originating from tpm_buf_init() allocation sites in tpm2_read_public()

Monitoring Recommendations

Track per-host trends in kernel memory usage and alert on monotonic growth that does not correspond to workload changes
Capture audit and telemetry data for processes interacting with /dev/tpm0 and /dev/tpmrm0 to identify high-frequency callers
Review distribution security trackers and stable kernel changelogs to confirm patch inclusion in deployed images

How to Mitigate CVE-2026-46096

Immediate Actions Required

Inventory hosts running Linux kernels that include the TPM2 sessions subsystem and identify versions predating the stable fix
Schedule kernel updates to a release that incorporates the tpm_buf_destroy() additions in tpm2_read_public()
Reboot updated systems to load the patched kernel image, since the fix resides in kernel space

Patch Information

The fix adds the missing tpm_buf_destroy() calls to both the name_size() error path and the success path of tpm2_read_public(). The change is published in the kernel stable tree under commits 2f434be87e25, f0f75a3d98b7, and f8775d9d9062. Apply vendor-supplied kernel updates that incorporate these commits, or rebuild from a stable tree that includes them.

Workarounds

Limit the frequency of TPM2 public-object reads from userspace where operationally feasible to slow leak accumulation
Schedule periodic reboots on systems that cannot be patched immediately to reset leaked kernel memory
Restrict access to TPM device nodes such as /dev/tpm0 and /dev/tpmrm0 to trusted processes to reduce the rate of triggering calls

bash

# Verify the running kernel version and check for the TPM2 fix
uname -r

# Inspect kernel package metadata for the stable commits referenced in the advisory
rpm -q --changelog kernel | grep -E 'tpm2_read_public|tpm_buf_destroy' || \
  dpkg-query -W -f='${binary:Package} ${Version}\n' 'linux-image-*'

# Restrict TPM device access to a trusted group
chgrp tss /dev/tpm0 /dev/tpmrm0
chmod 0660 /dev/tpm0 /dev/tpmrm0