CVE-2026-89763 Overview
CVE-2026-89763 is a use-after-free vulnerability in the Linux kernel's trusted keys subsystem. The flaw resides in trusted_tpm_exit(), which releases the TPM chip reference and frees the digest array before calling unregister_key_type(). This teardown ordering allows concurrent key operations to dereference freed memory. A local attacker with the ability to trigger trusted key creation while unloading the trusted module can read or corrupt kernel memory. KASAN confirmed the slab-use-after-free condition inside tpm_pcr_extend() during trusted_tpm_seal() execution.
Critical Impact
Local attackers can trigger a race condition leading to kernel memory corruption, potentially enabling privilege escalation or denial of service on affected Linux systems.
Affected Products
- Linux kernel builds shipping the trusted keys module (trusted.ko)
- Systems using TPM-backed trusted keys via the KEYS_TRUSTED_TPM subsystem
- Distributions consuming upstream stable kernels prior to the fix commits
Discovery Timeline
- 2026-09-11 - CVE-2026-89763 published to NVD
- 2026-09-13 - Last updated in NVD database
Technical Details for CVE-2026-89763
Vulnerability Analysis
The vulnerability stems from incorrect teardown ordering in the Linux kernel trusted keys module. When trusted_tpm_exit() runs during module unload, it drops the TPM chip reference via put_device(&chip->dev) and frees the digests array with kfree() before calling unregister_key_type().
The key_type_lookup() function holds key_types_sem for reading until the key operation completes. The unregister_key_type() call takes this semaphore for writing, providing the required synchronization barrier. Because unregistration happens last, in-flight key operations continue executing against freed backend state.
The race window permits an attacker on CPU 1 to invoke trusted_tpm_seal() and reach tpm_pcr_extend(..., digests) after CPU 0 has already freed digests. KASAN reported the resulting slab-use-after-free with a two-byte read at the freed address. The TPM chip structure can also be released while callbacks continue to reference it.
Root Cause
The root cause is an ordering bug classified as a Use-After-Free defect. Backend resources are destroyed before the key type is unregistered, violating the invariant that no key lookups can succeed after the backing device and digest buffers are released.
Attack Vector
Exploitation requires local access and the ability to invoke the add_key syscall against the trusted key type while another process unloads the trusted module via delete_module. The attacker races key instantiation against teardown to force pcrlock() and tpm_pcr_extend() to consume freed memory. Successful races can corrupt slab objects and destabilize kernel state.
See the Kernel Git Commit 2f7541a, Kernel Git Commit 5e2d672, and Kernel Git Commit 753c978 for the upstream remediation.
Detection Methods for CVE-2026-89763
Indicators of Compromise
- KASAN reports of slab-use-after-free in tpm_pcr_extend accompanied by trusted_tpm_seal and trusted_tpm_exit call stacks
- Unexpected kernel oops or panic messages referencing the trusted module during module unload sequences
- Concurrent add_key and delete_module syscalls issued by unprivileged user tasks
Detection Strategies
- Enable KASAN on test kernels to surface trusted key use-after-free conditions during fuzzing or regression runs
- Audit kernel logs for trusted_tpm_exit stack traces correlated with key subsystem faults
- Monitor delete_module invocations targeting trusted alongside spikes in add_key activity
Monitoring Recommendations
- Alert on unauthorized loading or unloading of the trusted kernel module on production hosts
- Collect syscall telemetry for add_key, keyctl, and delete_module to identify race attempts
- Track TPM driver error counters and kernel taint flags across the fleet to detect exploitation attempts
How to Mitigate CVE-2026-89763
Immediate Actions Required
- Apply the upstream stable kernel patches referenced in the vendor advisories and reboot affected systems
- Restrict CAP_SYS_MODULE to prevent unprivileged users from unloading the trusted module
- Restrict access to the add_key and keyctl interfaces on multi-tenant hosts until patches are deployed
Patch Information
Upstream commits reorder unregister_key_type() to run before put_device() and kfree(digests) inside trusted_tpm_exit(). This ensures new lookups are blocked and in-flight key operations complete before backend state is destroyed. Fix commits: 2f7541a, 5e2d672, and 753c978.
Workarounds
- Build kernels with the trusted keys module (CONFIG_TRUSTED_KEYS) statically linked to prevent runtime unload
- Disable module unloading globally by setting CONFIG_MODULE_UNLOAD=n where operationally viable
- Use SELinux or AppArmor policies to deny module operations for non-root users
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.