CVE-2026-99221

What it actually does

The flaw allows trusted_tpm_unseal() to ignore a TPM unseal failure when a subsequent pcrlock() call succeeds, causing the original error to be overwritten and key instantiation to succeed anyway.

Why it matters to the business

Systems relying on TPM-protected keys may grant access to sensitive cryptographic material without proper authorization checks, increasing risk of unauthorized data access or escalation in kernel-trusted key workflows.

How an attack unfolds

An attacker supplies or triggers a trusted key operation where the TPM unseal step fails; the code then proceeds to pcrlock() and, on its success, returns a success code instead of the unseal error, allowing the key to be instantiated and used.

How to fix it

Apply the kernel patch that returns immediately on unseal failure in trusted_tpm_unseal(); rebuild and deploy updated kernels to all affected systems.

How to confirm the fix worked

Confirm the presence of the immediate-return logic after unseal failure in the keys/trusted_keys source; test by forcing an unseal failure and verifying the original error is preserved.

Typical attack path

1. Trigger a trusted key instantiation that reaches trusted_tpm_unseal()
2. Cause the TPM unseal operation to fail
3. Ensure pcrlock() executes and succeeds
4. Receive a success return value for key creation despite the unseal failure
5. Use the incorrectly instantiated key for further operations

How to detect it

Review kernel logs and audit trails around trusted key operations for unexpected success returns following TPM-related failures; examine source history or running kernel for the corrected return behavior.

What your security team should do

• Prioritize kernel updates for systems using TPM-backed trusted keys
• Audit configurations that rely on trusted keys for authorization enforcement
• Monitor kernel update channels for the specific fix in the trusted keys subsystem