The Linux kernel's tpm2_read_public() function improperly manages memory buffers by failing to call tpm_buf_destroy() on two exit paths. Specifically, when name_size() returns an error due to an unrecognized hash algorithm, the function returns without releasing the allocated buffer. Additionally, on the success path, the buffer is also not destroyed before returning. Other error paths correctly free the buffer. This leads to a memory leak of page allocations within the TPM2 session code. The vulnerability has been resolved by adding the missing tpm_buf_destroy() calls.

The vulnerability causes a memory leak (denial of service via resource exhaustion) in the Linux kernel TPM2 session handling. There is no impact on confidentiality or integrity. The CVSS vector indicates local attack complexity and privileges required, with no user interaction needed, and the impact is limited to availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description indicates that a fix has been implemented by adding the missing tpm_buf_destroy() calls. Users should monitor official Linux kernel updates and apply patches when available.