KEYS: trusted: Fix TPM teardown ordering
CVE-2026-89763 · published 11 Sept 2026
How serious is it
- Severity: high, CVSS score 7.8 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-89763?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: 0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400 to < 81dfc6c665547a4e41721b6716f894f263a5e03f, 0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400 to < 3d67b4acbfc7af331d887a8efc04bef6573b8a7a, 0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400 to < 753c978f2400f9783eb524842a975d3ac950d511, 0b6cf6b97b7ef1fa3c7fefab0cac897a1c4a3400 to < 2f7541afbc57fe9d26769a22c31d8ce8790c9a19
- Linux Linux: 5.1
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
KEYS: trusted: Fix TPM teardown ordering
trusted_tpm_exit() drops the TPM chip reference and frees the digest
array before unregistering the trusted key type. key_type_lookup()
holds key_types_sem for reading until the key operation finishes, while
unregister_key_type() takes it for writing. It therefore provides the
synchronization point that must precede backend teardown.
The current order permits this interleaving:
CPU 0 CPU 1
trusted_tpm_exit() key_type_lookup("trusted")
put_device(&chip->dev) trusted_tpm_seal()
kfree(digests) pcrlock()
unregister_key_type() tpm_pcr_extend(..., digests)
CPU 1 can consequently dereference the freed digest array. The chip can
also be released before callbacks stop using it.
KASAN reported:
BUG: KASAN: slab-use-after-free in tpm_pcr_extend+0x1f0/0x200
Read of size 2 at addr ffff88810872d000 by task poc/89
Call Trace:
tpm_pcr_extend+0x1f0/0x200
pcrlock+0x42/0x70 [trusted]
trusted_tpm_seal+0x1b6/0x570 [trusted]
trusted_instantiate+0x293/0x340 [trusted]
__key_instantiate_and_link+0xb2/0x2b0
__key_create_or_update+0x61e/0xb50
__do_sys_add_key+0x1b8/0x310
Allocated by task 88:
__kmalloc_noprof+0x1a7/0x490
do_one_initcall+0xa1/0x390
do_init_module+0x2df/0x840
Freed by task 90:
kfree+0x131/0x3c0
trusted_tpm_exit+0x59/0xa0 [trusted]
__do_sys_delete_module+0x346/0x510
Move unregister_key_type() before releasing either resource. This stops
new lookups and waits for in-flight key operations to finish before the
backend state is destroyed.
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/81dfc6c665547a4e41721b6716f894f263a5e03f
- git.kernel.org/stable/c/3d67b4acbfc7af331d887a8efc04bef6573b8a7a
- git.kernel.org/stable/c/753c978f2400f9783eb524842a975d3ac950d511
- git.kernel.org/stable/c/2f7541afbc57fe9d26769a22c31d8ce8790c9a19
- git.kernel.org/stable/c/5e2d672280d97d83de43031d93761b12dadd7b8a
Merged from CVE List. Last updated 26 Oct 2026. All vulnerabilities · RSS · JSON