CVE-2026-72151

A flaw was found in the Linux kernel's Trusted Platform Module (TPM2) session handling. Specifically, the tpm_buf_append_salt() function does not properly manage asynchronous cryptographic key operations. This oversight can lead to a use-after-free vulnerability, where the system attempts to access memory that has already been released. This issue can be automatically triggered during routine system operations, potentially allowing a local attacker to cause a system crash or, in some scenarios, escalate their privileges.

This vulnerability is rated as Moderate severity because triggering the underlying memory corruption requires specific asynchronous cryptographic accelerator hardware drivers. In standard Red Hat deployments using synchronous software crypto algorithms, the cryptographic operations finish immediately and do not trigger the premature release of request memory. Consequently, the operational impact leading to kernel crashes or potential privilege escalation is restricted to environments with specialized cryptographic coprocessors.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.