{"id":"CVE-2026-98221","revision":"38e3425f9d4149c4a4fa0dd7441e4290","records":[{"revision":"38e3425f9d4149c4a4fa0dd7441e4290","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98221","aliases":[],"title":"KEYS: trusted: Fix tpm2_load_cmd() boundary check","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKEYS: trusted: Fix tpm2_load_cmd() boundary check\n\ntpm2_load_cmd() does boundary checks against the ASN.1 size i.e.,\npayload->blob_len. Address this by passing the decoded blob size to\ntpm2_load_cmd(), and use it for the boundary checks.","state":0,"publishedAt":"2026-10-06T08:44:56.728+00:00","modifiedAt":"2026-10-19T09:15:53.271+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"security/keys/trusted-keys/trusted_tpm2.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"f2219745250f388edacabe6cca73654131c67d0a\",\n                            \"lessThan\": \"cc86227fea28aed86c1fb52a884560b4440da198\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f2219745250f388edacabe6cca73654131c67d0a\",\n                            \"lessThan\": \"b020b447338872440142fe8a57350a483da86b7a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f2219745250f388edacabe6cca73654131c67d0a\",\n                            \"lessThan\": \"3fd487c69ad3161e358c33c170bab0cf02a071b7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f2219745250f388edacabe6cca73654131c67d0a\",\n                            \"lessThan\": \"5afa57ea91481c6c49f194b0f5a5c4d96a4d7348\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f2219745250f388edacabe6cca73654131c67d0a\",\n                            \"lessThan\": \"9ddbc5f4bb498aff8096a5231574858a4bffee4f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f2219745250f388edacabe6cca73654131c67d0a\",\n                            \"lessThan\": \"134825dfc971fbf2b1d0f58f0b3bce8332ad0afb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f2219745250f388edacabe6cca73654131c67d0a\",\n                            \"lessThan\": \"114f00d738f15dd8c7318369edcdc53dd6d08763\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"security/keys/trusted-keys/trusted_tpm2.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.13\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.13\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.222\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.189\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.112\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.54\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.8\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/cc86227fea28aed86c1fb52a884560b4440da198","https://git.kernel.org/stable/c/b020b447338872440142fe8a57350a483da86b7a","https://git.kernel.org/stable/c/3fd487c69ad3161e358c33c170bab0cf02a071b7","https://git.kernel.org/stable/c/5afa57ea91481c6c49f194b0f5a5c4d96a4d7348","https://git.kernel.org/stable/c/9ddbc5f4bb498aff8096a5231574858a4bffee4f","https://git.kernel.org/stable/c/134825dfc971fbf2b1d0f58f0b3bce8332ad0afb","https://git.kernel.org/stable/c/114f00d738f15dd8c7318369edcdc53dd6d08763"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98221","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98221","identifiers":["CVE-2026-98221"]},"retained":false,"historicalAffected":[]}],"coverage":[]}