CVE-2026-89763

In the Linux kernel, the following vulnerability has been resolved:

KEYS: trusted: Fix TPM teardown ordering

trusted tpm exit() drops the TPM chip reference and frees the digest array before unregistering the trusted key type. key type lookup() holds key types sem for reading until the key operation finishes, while unregister key type() takes it for writing. It therefore provides the synchronization point that must precede backend teardown.

The current order permits this interleaving:

CPU 0 CPU 1 trusted tpm exit() key type lookup("trusted") put device(&chip->dev) trusted tpm seal() kfree(digests) pcrlock() unregister key type() tpm pcr extend(..., digests)

CPU 1 can consequently dereference the freed digest array. The chip can also be released before callbacks stop using it.

KASAN reported:

BUG: KASAN: slab-use-after-free in tpm pcr extend+0x1f0/0x200 Read of size 2 at addr ffff88810872d000 by task poc/89 Call Trace: tpm pcr extend+0x1f0/0x200 pcrlock+0x42/0x70 [trusted] trusted tpm seal+0x1b6/0x570 [trusted] trusted instantiate+0x293/0x340 [trusted] key instantiate and link+0xb2/0x2b0 key create or update+0x61e/0xb50 do sys add key+0x1b8/0x310 Allocated by task 88: kmalloc noprof+0x1a7/0x490 do one initcall+0xa1/0x390 do init module+0x2df/0x840 Freed by task 90: kfree+0x131/0x3c0 trusted tpm exit+0x59/0xa0 [trusted] do sys delete module+0x346/0x510

Move unregister key type() before releasing either resource. This stops new lookups and waits for in-flight key operations to finish before the backend state is destroyed.