In the Linux kernel, the following vulnerability has been resolved: tpm: fix off-by-four bounds check in tpm2_get_random() When the response carries… (CVE-2026-98728)

The Linux kernel's tpm2_get_random() function improperly performed a bounds check when handling TPM2_ST_SESSIONS-tagged responses. It skipped a 4-byte parameter size field before accessing random data but validated the response length only against TPM_HEADER_SIZE. This mismatch allowed a truncated response to pass the check, causing memcpy() to read up to 4 bytes beyond the response buffer. The fix involved adjusting the bounds check to compare the response length against an offset that includes the skipped parameter size field, preventing out-of-bounds reads.

An attacker could cause the function to return up to 4 bytes of stale buffer data as part of the random output. This could lead to unintended information disclosure of residual memory contents. There is no indication of code execution or system compromise. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to correct the bounds check in tpm2_get_random(). Users should apply the official kernel update containing this patch when it becomes available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.