In the Linux kernel, the following vulnerability has been resolved: tpm: Disable TPM on null key name mismatch The null key name check exists to… (CVE-2026-98845)

The Linux kernel TPM driver contained a vulnerability where the null key name integrity check failed to disable the TPM chip upon mismatch. Specifically, the function tpm2_load_null() returned success (rc=0) even when the null key name check failed, causing the chip to remain enabled and the caller to proceed with an uninitialized null key handle. This could result in TPM commands being executed with invalid key handles, potentially undermining TPM security guarantees. The fix sets the return code to -ENODEV on mismatch, which disables the chip and returns an error to the caller, preventing further TPM commands. The fix was tested in QEMU with swtpm and the CONFIG_TCG_TPM2_HMAC kernel option.

The vulnerability allowed the TPM chip to continue processing commands despite a null key name integrity failure, which could lead to the use of uninitialized or invalid key handles in TPM operations. This undermines the TPM's protection against reset attacks and could potentially compromise TPM-based security functions relying on the null key integrity check.

A fix has been implemented in the Linux kernel TPM driver that disables the TPM chip upon null key name mismatch by returning an error code. Users should update to a Linux kernel version that includes this fix. Since this is a kernel-level vulnerability, applying the official kernel update is the recommended remediation. No additional mitigations are specified.