CVE-2026-72432

A flaw was found in the Linux kernel's Trusted Platform Module (TPM) Command Response Buffer (CRB) driver. This vulnerability occurs because the driver does not properly check for the presence of an Advanced Configuration and Power Interface (ACPI) companion object during device probing. An attacker could potentially exploit this by forcing the driver to match a device without an ACPI companion, which may lead to a system crash or denial of service.

A low impact flaw was found in the Linux kernel's TPM (Trusted Platform Module) Command Response Buffer (CRB) driver. The driver did not validate the presence of a device's ACPI companion object during probing. Because a platform driver can be forced to match a device outside its supported ID list through driver_override matching, a local attacker with the ability to control driver binding (typically requiring elevated privileges) could force the tpm_crb driver to probe a device that has no ACPI companion object, resulting in a NULL pointer dereference during probe and a kernel crash, causing a denial of service. The available evidence supports no confidentiality or integrity impact.

Red Hat Enterprise Linux 7, 8, 9, and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 2 are not affected because the vulnerable code is not present in these releases. The Red Hat Enterprise Linux 6 Extended Lifecycle Support kernel is out of support scope. Although the Red Hat CVSS 3.1 base score is 5.5 (moderate, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), the impact is rated low because exploitation requires local access with control over driver binding and the consequence is limited to denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.