CVE-2026-90070
kernel: tpm: st33zp24: Return zero on status read failure
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 17, 2026
Updated · October 13, 2026
Description
A flaw was found in the Linux kernel's Trusted Platform Module (TPM) driver for the ST33ZP24 chip. The st33zp24_status() function does not correctly handle errors when reading data from the I2C transport. This can result in uninitialized data being interpreted as valid TPM status flags, leading to incorrect status checks and potentially causing system instability or denial of service by making callers act on invalid status values.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-908 · Use of Uninitialized Resource