CVE-2026-89763

What it actually does

Use-after-free in the trusted TPM key backend: trusted_tpm_exit releases the TPM chip reference and kfree's the digest array before unregister_key_type completes, allowing concurrent key_type_lookup callers to invoke tpm_pcr_extend on freed memory.

Why it matters to the business

Local users can trigger kernel crashes or memory corruption on systems that load and unload the trusted key module while performing TPM-backed key operations, potentially leading to denial of service or local privilege escalation.

How an attack unfolds

An attacker with local access loads the trusted module, starts a key creation or sealing operation that holds key_types_sem, then forces module unload so trusted_tpm_exit frees the digests array; the in-flight operation then dereferences the freed memory inside tpm_pcr_extend.

How to fix it

Apply the upstream fix that moves unregister_key_type before put_device and kfree of the digest array; rebuild and boot the patched kernel. Disable or avoid use of the trusted TPM key type until updated kernels are deployed.

How to confirm the fix worked

Confirm the patch is present by inspecting the trusted.c source for unregister_key_type preceding resource release; verify no KASAN reports occur during module unload while key operations are active; test on a non-production system with the reproducer sequence.

Typical attack path

1. Obtain local shell on target Linux system
2. Trigger loading of the trusted key module and perform a key operation that reaches trusted_tpm_seal
3. Concurrently unload the module to execute trusted_tpm_exit
4. Continue the key operation so it calls tpm_pcr_extend on the now-freed digest array
5. Observe KASAN use-after-free or trigger kernel panic / memory corruption

How to detect it

Search kernel logs and KASAN reports for slab-use-after-free involving tpm_pcr_extend, pcrlock, or trusted_tpm_seal during module unload; inspect crash dumps for freed digest arrays referenced after trusted_tpm_exit; correlate with keyctl or add_key syscalls occurring near module deletion.

• BUG: KASAN: slab-use-after-free in tpm_pcr_extend
• trusted_tpm_exit
• kfree(digests)
• unregister_key_type
• poc/.*tpm_pcr_extend

What your security team should do

• Prioritize kernel updates containing the teardown ordering fix on all systems that compile or load the trusted key module
• Restrict local user access to keyctl and module loading until patches are applied
• Monitor for KASAN or slab-use-after-free reports mentioning tpm_pcr_extend or trusted_tpm_exit
• Review any custom initramfs or early-boot scripts that load/unload the trusted module