CVE-2026-89763

A flaw was found in the Linux kernel's Trusted Platform Module (TPM) trusted keys subsystem. An incorrect teardown ordering during the exit process of trusted TPM keys can lead to a race condition. This allows a local attacker to potentially dereference a freed memory region, resulting in a use-after-free vulnerability. Successful exploitation of this flaw could lead to system instability, a denial of service (DoS), or potentially arbitrary code execution.

A MODERATE severity use-after-free flaw was found in the Linux kernel's Trusted Platform Module (TPM) trusted keys subsystem. During module exit, trusted_tpm_exit() drops the TPM chip reference and frees the digest array before the trusted key type is unregistered. Because key_type_lookup() holds key_types_sem for reading until a key operation completes and unregister_key_type() takes that semaphore for writing, unregistering the key type is the synchronization point that must happen before backend teardown. With the incorrect ordering, a concurrent key operation such as sealing a trusted key (which calls pcrlock() and then tpm_pcr_extend() using the digest array) can dereference the freed digest array or use the released TPM chip. A local attacker able to race trusted-key operations against module teardown could cause a kernel crash (denial of service) or potentially arbitrary code execution.

Red Hat Enterprise Linux kernel and kernel-rt, Red Hat OpenShift Container Platform (through its RHEL CoreOS kernels), and Red Hat In-Vehicle OS kernels are affected. Red Hat Enterprise Linux 6 and 7 kernel and kernel-rt are not affected because the vulnerable code is not present in those versions.

Because the Red Hat severity is MODERATE (CVSS3 5.5, below the threshold at which trackers are filed for MODERATE flaws), fixes for the affected products are currently deferred; the residual risk is limited to local attackers who can race module teardown with trusted-key operations. The CVE.org record assigns a higher score of 7.8 (IMPORTANT) with high confidentiality, integrity, and availability impact. Red Hat's MODERATE rating reflects that exploitation requires local access, that the bug is triggered by racing the trusted-key module teardown path, and that the most realistic consequence is loss of availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.