CVE-2026-46283

A flaw was found in the Linux kernel's Trusted Platform Module (TPM) driver. This vulnerability arises from the driver's failure to securely clear sensitive cryptographic material, such as session keys and passphrases, from memory when a TPM device is released. A local attacker could potentially exploit this by accessing the unscrubbed memory, leading to the disclosure of confidential cryptographic information. This could compromise the integrity and confidentiality of cryptographic operations.

This vulnerability is rated as Moderate severity because exploitation requires local access and is limited to systems where TPM 2.0 authentication sessions are actively closed, leaving residual data in unscrubbed kernel memory. While exposed slab memory may contain ephemeral cryptographic secrets or nonces until overwritten, the flaw cannot be triggered or exploited remotely, nor does it allow direct privilege escalation. Furthermore, older enterprise releases, including Red Hat Enterprise Linux 8 and 9, lack the affected session handling implementation and remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.