VulnerabilityPublished 18 Oct 2026

CVE-2026-98845: Linux kernel · tpm: Disable TPM on null key name mismatch

Source GCVE Database

Authoritative record:CVE-2026-98845· High

Not known to be exploited · fixed in f6599d8830fe7ddab7334cc17846fd9ac9a7fa50 : patch Linux kernel soon.

Data as of 26 Oct 2026, 14:05 UTC

Severity

High

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 4% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in f6599d8830fe7ddab7334cc17846fd9ac9a7fa50, a03d0c64cd827a622578623a78defd66b6593b82, 96c46c75b0d470b4204f9fe1bdb075cd2ebaebfa +2

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-g3p5-hgwr-rqx7

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected >=6.11.7 <6.12 >=6.11.10 <6.12	Fixed in f6599d8830fe7ddab7334cc17846fd9ac9a7fa50 a03d0c64cd827a622578623a78defd66b6593b82 96c46c75b0d470b4204f9fe1bdb075cd2ebaebfa 015fb29a748342a186f37b602ac70017098c8251 6.12
LinuxLinux	Affected =6.12	Fixed in–

AI-suggested

A fix has been implemented in the Linux kernel TPM driver that disables the TPM chip upon null key name mismatch by returning an error code. Users should update to a Linux kernel version that includes this fix. Since this is a kernel-level vulnerability, applying the official kernel update is the recommended remediation. No additional mitigations are specified.

Description

A vulnerability in the Linux kernel TPM driver was resolved that previously allowed the TPM chip to continue serving requests despite a null key name integrity check failure. The null key name check is intended to protect against TPM reset attacks by disabling the chip on mismatch, but the chip remained enabled due to a logic flaw. This could lead to the use of uninitialized key handles in TPM commands. The fix changes the return code on mismatch to disable the chip and prevent further commands.

Impact

The vulnerability allowed the TPM chip to continue processing commands despite a null key name integrity failure, which could lead to the use of uninitialized or invalid key handles in TPM operations. This undermines the TPM's protection against reset attacks and could potentially compromise TPM-based security functions relying on the null key integrity check.

Summary

The Linux kernel TPM driver contained a vulnerability where the null key name integrity check failed to disable the TPM chip upon mismatch. Specifically, the function tpm2_load_null() returned success (rc=0) even when the null key name check failed, causing the chip to remain enabled and the caller to proceed with an uninitialized null key handle. This could result in TPM commands being executed with invalid key handles, potentially undermining TPM security guarantees. The fix sets the return code to -ENODEV on mismatch, which disables the chip and returns an error to the caller, preventing further TPM commands. The fix was tested in QEMU with swtpm and the CONFIG_TCG_TPM2_HMAC kernel option.

References

Community reviews

Loading reviews…