CVE-2026-46283

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The tpm dev release() function uses kfree() instead of kfree sensitive() to free chip->auth. This structure contains sensitive cryptographic material, including HMAC session keys, nonces, and passphrase data. While other code paths such as tpm2 end auth session() and tpm buf check hmac response() correctly zero the memory before releasing it, the tpm dev release() path leaves key material in freed slab memory until it is overwritten.

Recommendations Update to the version that implements kfree sensitive() in the tpm dev release() function to ensure session keys are scrubbed during device teardown.