{"id":"CVE-2026-90070","revision":"5382f608847940c68d15d99d336686c7","records":[{"revision":"5382f608847940c68d15d99d336686c7","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90070","aliases":[],"title":"tpm: st33zp24: Return zero on status read failure","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: st33zp24: Return zero on status read failure\n\nst33zp24_status() ignores the result of the transport read and returns\ndata even when no byte was received. The I2C transport, for example,\nskips i2c_master_recv() when the register-select write is short or fails,\nleaving data uninitialized. The resulting stack value can be interpreted\nas TPM_STS flags and let status checks complete spuriously.\n\nThe status callback cannot propagate a transport error. Return zero\nunless recv() reports exactly one byte. With no status bits set, callers\nretry or take their existing timeout or error path instead of acting on\nan invalid status value.\n\nThis issue was found by a static analysis checker and confirmed by manual\nsource review.","state":0,"publishedAt":"2026-09-17T16:05:51.585+00:00","modifiedAt":"2026-10-19T08:57:27.372+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/char/tpm/st33zp24/st33zp24.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"251a7b08213af82e40e4a70cac056e245853c410\",\n                            \"lessThan\": \"d732cfc4befe28f02ec82ed5fd2bc2a21fbabd42\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"251a7b08213af82e40e4a70cac056e245853c410\",\n                            \"lessThan\": \"4973e8386257eed10e5433a94a53bcc6ec37d2a1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"251a7b08213af82e40e4a70cac056e245853c410\",\n                            \"lessThan\": \"981307e2e8a930da492c2bcf763865c47c2a5165\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"251a7b08213af82e40e4a70cac056e245853c410\",\n                            \"lessThan\": \"1bfd5c54e40704ce93d128a25de3d8dd772bf183\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"251a7b08213af82e40e4a70cac056e245853c410\",\n                            \"lessThan\": \"38c26fe4522963a91d4fb02c844d8faa740fe9d1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"251a7b08213af82e40e4a70cac056e245853c410\",\n                            \"lessThan\": \"14feaa498c20c1b7ddefe27de5329aaff822cc0d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"251a7b08213af82e40e4a70cac056e245853c410\",\n                            \"lessThan\": \"e6d7d9b665419cda3e9f91030d81c9f8ba71e51d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"251a7b08213af82e40e4a70cac056e245853c410\",\n                            \"lessThan\": \"8b92687708f5ef980de01c2042dbd76d11f78547\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/char/tpm/st33zp24/st33zp24.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.9\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.9\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.270\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.221\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.52\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/d732cfc4befe28f02ec82ed5fd2bc2a21fbabd42","https://git.kernel.org/stable/c/4973e8386257eed10e5433a94a53bcc6ec37d2a1","https://git.kernel.org/stable/c/981307e2e8a930da492c2bcf763865c47c2a5165","https://git.kernel.org/stable/c/1bfd5c54e40704ce93d128a25de3d8dd772bf183","https://git.kernel.org/stable/c/38c26fe4522963a91d4fb02c844d8faa740fe9d1","https://git.kernel.org/stable/c/14feaa498c20c1b7ddefe27de5329aaff822cc0d","https://git.kernel.org/stable/c/e6d7d9b665419cda3e9f91030d81c9f8ba71e51d","https://git.kernel.org/stable/c/8b92687708f5ef980de01c2042dbd76d11f78547"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90070","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90070","identifiers":["CVE-2026-90070"]},"retained":false,"historicalAffected":[]}],"coverage":[]}