CVE-2026-72151

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the tpm buf append salt() function within drivers/char/tpm/tpm2-sessions.c. The function calls crypto kpp generate public key() and crypto kpp compute shared secret() without installing a completion callback and immediately frees the kpp request using kpp request free(). When the ecdh-nist-p256 KPP (Key Exchange) backend is asynchronous, such as with atmel-ecc, HPRE, or keembay-ocs, the operation returns -EINPROGRESS, leading a deferred completion worker to dereference the freed request. This process is triggered automatically by the hwrng fillfn kernel thread during entropy polls via the path tpm get random -> tpm2 get random -> tpm2 start auth session -> tpm buf append salt, requiring no userland interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.