The Linux kernel vulnerability CVE-2026-46096 involves the TPM2 sessions subsystem where the function tpm2_read_public() calls tpm_buf_init() to allocate a buffer but fails to call tpm_buf_destroy() on two exit paths. Specifically, when name_size() returns an error due to an unrecognized hash algorithm, and on the success path, the buffer is not destroyed, leading to a page allocation leak. Other error paths correctly destroy the buffer. This memory leak can degrade system availability. The issue affects multiple linux-hwe-edge kernel versions prior to 7.0.0-27.27, 7.0.0-28.28~24.04.1, 7.0.0-1008.8, 7.0.0-1009.9, and 7.0.0-1010.10. A patch has been released by Ubuntu as part of a broader Linux kernel security update.

The vulnerability causes a memory leak in the Linux kernel TPM2 sessions subsystem, which can lead to resource exhaustion and impact system availability. There is no impact on confidentiality or integrity. The CVSS v3.1 score is 5.5 (medium severity) with attack vector local, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high impact on availability.

An official patch is available and should be applied by updating the Linux kernel to the fixed versions listed in the Ubuntu security advisory USN-8488-1 and USN-8489-1. After applying the update, a system reboot is required to complete remediation. Due to an ABI change, third-party kernel modules must be recompiled and reinstalled. No additional mitigation steps are necessary beyond applying the official update.