CVE-2025-68792

What it actually does

Out-of-bounds array indexing via unvalidated TPM_ALG_ID in name_size leads to memory corruption in TPM2 session handling; additional changes make tpm_buf_append_name and tpm_buf_fill_hmac_session fallible and terminate sessions on error.

Why it matters to the business

Kernel memory corruption on Linux systems using TPM 2.0 can cause crashes, denial of service, or potential privilege escalation; 286 days have passed since disclosure with stable low exploit probability and no known ransomware use.

How an attack unfolds

An attacker supplies an unrecognized TPM_ALG_ID value to bypass missing range checks, triggering invalid memory access during session setup before error paths were added.

How to fix it

Apply the Linux kernel commit 47e676ce4d68f461dfcab906f6aeb254f7276deb which enforces known-value checks, returns -EINVAL for invalid IDs, and makes the listed functions fallible.

How to confirm the fix worked

Confirm the running kernel source contains commit 47e676ce4d68f461dfcab906f6aeb254f7276deb; test with unrecognized TPM_ALG_ID values and verify -EINVAL is returned without corruption.

Typical attack path

1. Locate Linux systems exposing TPM2 interfaces
2. Craft input containing an out-of-range TPM_ALG_ID
3. Trigger name_size indexing in tpm2-sessions
4. Induce memory corruption or session state errors

How to detect it

Inspect kernel logs and dmesg for TPM2 session errors, invalid algorithm references, or memory faults originating from tpm2-sessions code paths.

What your security team should do

• Patch all affected kernels to the fixed commit without delay
• Review TPM2 usage and disable where unnecessary
• Monitor kernel logs for TPM session errors
• Prioritize systems with high TPM2 exposure