CVE-2026-46283: Linux Kernel TPM Information Disclosure

CVE-2026-46283 Overview

CVE-2026-46283 is a Linux kernel vulnerability in the Trusted Platform Module (TPM) driver. The tpm_dev_release() function uses plain kfree() to release chip->auth, a structure (struct tpm2_auth) that holds HMAC session keys, nonces, and passphrase data. Because the memory is not zeroed before being returned to the slab allocator, sensitive cryptographic material remains in freed memory until overwritten by later allocations. The fix replaces kfree() with kfree_sensitive() to scrub the buffer on device teardown, matching the behavior of tpm2_end_auth_session() and tpm_buf_check_hmac_response().

Critical Impact
TPM authentication session keys and passphrase material can persist in freed kernel slab memory, exposing them to disclosure through subsequent allocations that reuse the same memory region.

Affected Products

Linux kernel TPM subsystem (drivers/char/tpm/)
Stable kernel branches receiving commits 53e6d2d, 84ced03, c424d26, and dd3ac52
Distributions shipping affected stable kernel versions prior to backport

Discovery Timeline

2026-06-08 - CVE-2026-46283 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-46283

Vulnerability Analysis

The Linux kernel TPM driver maintains a per-chip authentication structure, chip->auth, which stores HMAC session keys, freshness nonces, and passphrase material used to protect commands sent to a TPM 2.0 device. The driver consistently releases this structure with kfree_sensitive() in tpm2_end_auth_session() and tpm_buf_check_hmac_response(), both of which zero the buffer before freeing it.

tpm_dev_release(), the character device release handler, was the only code path that called plain kfree() on chip->auth. As a result, when the TPM character device was torn down, the cryptographic material remained intact in the slab cache until a future allocation happened to overwrite the same bytes.

This is an information disclosure issue rooted in inconsistent use of memory-scrubbing free helpers. It is classified as a kernel information exposure ([CWE-212] / [CWE-244]-style) defect.

Root Cause

The root cause is the use of kfree() rather than kfree_sensitive() for a buffer containing secrets. kfree_sensitive() calls memzero_explicit() on the allocation before returning it to the allocator, which prevents secret retention. The TPM teardown path missed this requirement, breaking the invariant that every release of struct tpm2_auth zeroizes its contents.

Attack Vector

Exploitation requires local access and the ability to influence kernel slab allocations after a TPM device release. An attacker with code execution in a context that can trigger same-size kmalloc allocations may read residual memory containing HMAC session keys or passphrase fragments. The issue is not network reachable and does not directly grant code execution, but it can undermine the integrity guarantees of TPM-protected operations if session material is recovered.

No public proof-of-concept code is referenced in the advisory. Readers should consult the upstream commits for the implementation-level fix: Kernel Git Commit 53e6d2d, Kernel Git Commit 84ced03, Kernel Git Commit c424d26, and Kernel Git Commit dd3ac52.

Detection Methods for CVE-2026-46283

Indicators of Compromise

No reliable runtime IOCs exist for this class of memory-residue disclosure because freed slab memory is not logged by the kernel.
Presence of an unpatched kernel package containing tpm_dev_release() calling kfree(chip->auth) rather than kfree_sensitive(chip->auth) indicates exposure.

Detection Strategies

Audit installed kernel versions against vendor security trackers and confirm whether the four upstream commits are backported.
Use source or binary diffing to verify that tpm_dev_release() in drivers/char/tpm/tpm-chip.c invokes kfree_sensitive() on chip->auth.
Inventory hosts that interact with TPM 2.0 (/dev/tpm0, /dev/tpmrm0) and prioritize them for patch validation.

Monitoring Recommendations

Monitor for unexpected processes opening TPM character devices, especially short-lived processes that open and immediately close /dev/tpm0.
Track kernel module and package updates through configuration management to confirm patched kernels are deployed across the fleet.
Alert on local privilege escalation or kernel-memory-read primitives, which are prerequisites for extracting residual secrets.

How to Mitigate CVE-2026-46283

Immediate Actions Required

Apply the stable kernel update that incorporates the upstream fix replacing kfree() with kfree_sensitive() in tpm_dev_release().
Reboot affected systems after upgrade so the patched kernel and TPM driver are active.
Restrict access to TPM character devices to the smallest set of privileged users and services required for operation.

Patch Information

The vulnerability is resolved by the upstream Linux kernel commits 53e6d2d, 84ced03, c424d26, and dd3ac52. Each commit changes tpm_dev_release() to use kfree_sensitive(chip->auth) so the structure is zeroized before being returned to the slab allocator. Update to the corresponding stable release for your kernel branch and any distribution-provided backports.

Workarounds

No reliable workaround exists short of patching; the cleanup logic lives inside the TPM driver itself.
On systems that do not require TPM 2.0 in-kernel HMAC sessions, restrict or disable the TPM character device interface to limit which users can trigger the affected code path.
Reduce local attack surface by enforcing least privilege and removing unnecessary local accounts on hosts that hold TPM-protected secrets.

bash

# Verify the running kernel and confirm whether the TPM fix is present
uname -r
grep -n "kfree_sensitive" /usr/src/linux-$(uname -r)/drivers/char/tpm/tpm-chip.c 2>/dev/null

# Restrict access to TPM character devices to the tss group
chgrp tss /dev/tpm0 /dev/tpmrm0
chmod 0660 /dev/tpm0 /dev/tpmrm0