CVE-2026-98728

A flaw was found in the Linux kernel's Trusted Platform Module (TPM) driver. This flaw can lead to information disclosure when the kernel requests random data. Due to an incorrect bounds check when processing session-tagged responses, a truncated response can pass validation and cause the kernel to read past the end of the buffer. Consequently, stale kernel memory contents may be returned to the caller instead of random data, potentially exposing sensitive information.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.