{"id":"CVE-2026-98728","revision":"86e6c9c2afff4703af61b948d3f114ef","records":[{"revision":"86e6c9c2afff4703af61b948d3f114ef","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98728","aliases":[],"title":"tpm: fix off-by-four bounds check in tpm2_get_random()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: fix off-by-four bounds check in tpm2_get_random()\n\nWhen the response carries the TPM2_ST_SESSIONS tag, tpm2_get_random()\nskips the 4-byte parameter size field before locating the random data,\nbut the bounds check still validates the response length against\nTPM_HEADER_SIZE.  A truncated response can pass the check and make\nmemcpy() read up to 4 bytes past the response end, so stale buffer\ncontents end up in the caller's random bytes.\n\nFix this by checking the response length against 'offset', which\nalready includes the skipped parameter size field.","state":0,"publishedAt":"2026-10-18T15:47:05.722+00:00","modifiedAt":"2026-10-19T09:24:38.853+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/char/tpm/tpm2-cmd.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497\",\n                            \"lessThan\": \"be54101992c2c5218be0e0a87827ccc96e3089af\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497\",\n                            \"lessThan\": \"e30a2406408d2df6d9cd48c2e59e913cf266a05a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497\",\n                            \"lessThan\": \"42bb6216b861e892512128219ff23010d656ba14\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497\",\n                            \"lessThan\": \"9b522400bf5c082feb9a0037a053ea822a2c7e4d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/char/tpm/tpm2-cmd.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.10\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.10\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.113\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.56\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.10\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/be54101992c2c5218be0e0a87827ccc96e3089af","https://git.kernel.org/stable/c/e30a2406408d2df6d9cd48c2e59e913cf266a05a","https://git.kernel.org/stable/c/42bb6216b861e892512128219ff23010d656ba14","https://git.kernel.org/stable/c/9b522400bf5c082feb9a0037a053ea822a2c7e4d"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98728","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98728","identifiers":["CVE-2026-98728"]},"retained":false,"historicalAffected":[]}],"coverage":[]}