CVE-2026-98221

What it actually does

The vulnerability was an incorrect boundary check in tpm2_load_cmd() that used the ASN.1-encoded payload size instead of the decoded blob length, allowing potential out-of-bounds memory access when loading trusted keys via TPM2.

Why it matters to the business

Systems relying on TPM-backed trusted keys in the Linux kernel could experience crashes, denial of service, or local privilege escalation, affecting secure boot, disk encryption, or attestation workloads until patched.

How an attack unfolds

An attacker with local access supplies a crafted key blob to the trusted keys subsystem; because the size check used the wrong length field, the kernel could read or write beyond intended buffers during TPM2 command processing.

How to fix it

Apply the upstream kernel commit that passes the decoded blob size to tpm2_load_cmd and update to a fixed kernel release; rebuild and reboot all affected systems.

How to confirm the fix worked

Confirm the patch is present by inspecting the tpm2_load_cmd function for the decoded-size parameter; test with a boundary-case key blob to ensure no crash occurs.

Typical attack path

1. Obtain local code execution on a Linux system using TPM trusted keys
2. Prepare a malicious ASN.1-encoded blob with mismatched decoded size
3. Invoke keyctl or equivalent interface to load the blob via tpm2_load_cmd
4. Trigger out-of-bounds access leading to kernel panic or memory corruption

How to detect it

Look in kernel logs for oops or panic messages referencing tpm2_load_cmd or trusted keys around the time of key operations; no public exploitation artifacts are known.

What your security team should do

• Prioritize kernel updates on any system using TPM trusted keys or the KEYS subsystem
• Monitor for new stable kernel releases containing the fix
• Review local key-loading code paths for exposure
• Consider disabling TPM trusted keys if the feature is unused until patched