CVE-2026-98221

A flaw was found in the Linux kernel's trusted keys subsystem. A local user can exploit this vulnerability by submitting a specially crafted trusted key payload. Because the kernel validates boundaries against the encoded data length rather than the decoded buffer size, an out-of-bounds memory read can occur. This issue can lead to a system crash, resulting in a denial of service (DoS), or potentially expose sensitive kernel memory.

An incorrect boundary check in the Trusted Keys TPM2 path compares offsets in a decoded key blob against payload blob_len which describes the larger ASN.1 representation. A malformed key can therefore pass validation even when private_len or public_len points beyond the allocated decoded buffer, leading to an out of bounds read in get_unaligned_be16 or later public data processing. For the CVSS the PR:L value is used because triggering requires a local process to submit a crafted Trusted Key blob through the key management interface, while full administrative privileges are not proven to be universally required. The issue is not network reachable through this code path. Impact is at least a possible local denial of service through an invalid kernel memory read, while the paranoid assessment also considers limited confidentiality impact if adjacent kernel data is copied into a TPM command or otherwise becomes observable. No integrity impact is assigned because the available code establishes an out of bounds read but not an out of bounds write or arbitrary write primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.