CVE-2026-72152

tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()

Published Aug 15, 2026 CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()

wait_event_interruptible_timeout() evaluates its condition after setting
the current task state to TASK_INTERRUPTIBLE.

With CONFIG_DEBUG_ATOMIC_SLEEP this triggers a warning when the IRQ wait
path is used:

tpm_tis_status()
tpm_tis_spi_read_bytes()
tpm_tis_spi_transfer_full()
spi_bus_lock()
mutex_lock()

Address this with the following measures:

1. Call wait_tpm_stat_cond() only while tasking is running.
2. Use wait_woken() to wait for changes.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1a339b658d9dbe1471f67b78237cf8fa08bbbeb5`	affected	< 45ceeb08bf1f4f7353ffb529d8682a0cf5506318
`1a339b658d9dbe1471f67b78237cf8fa08bbbeb5`	affected	< eef71c01deb08547956df3634a0d34c6bdbcecb8
`1a339b658d9dbe1471f67b78237cf8fa08bbbeb5`	affected	< c9acbe38797bc1aa3c22a1ab72452e210af6e0ff
`1a339b658d9dbe1471f67b78237cf8fa08bbbeb5`	affected	< 6b068a97958aa00a901a9b5083d74114b21f7b66
`1a339b658d9dbe1471f67b78237cf8fa08bbbeb5`	affected	< bb63a0530e8e6de3aaf29cd5ba487db2490128ef
`1a339b658d9dbe1471f67b78237cf8fa08bbbeb5`	affected	< ba33b4f9d3423accd2c91a0b0b0680cd589922f2
`1a339b658d9dbe1471f67b78237cf8fa08bbbeb5`	affected	< 4bb3e1bc142dc9c3240ceed1b3ab031aa9cb1723
`1a339b658d9dbe1471f67b78237cf8fa08bbbeb5`	affected	< c0c9cfb3b75def8bf200a2d4db09015806acfeaf
`cd4ae0b05126cc9461a2e50ccb745e5583cc91e2`	affected	—
`cf503dbe5c22c6ab9797e1cf864a11597d711c3a`	affected	—
`d229e7ecc0cb29996688f0fa98c5eb6128b81e3a`	affected	—
`4.9.128`	affected	< 4.10
`4.14.71`	affected	< 4.15
`4.18.9`	affected	< 4.19

Linux

affected

Version	Status	Constraints
`4.19`	affected	—
`0`	unaffected	< 4.19
`5.10.266`	unaffected	≤ 5.10.*
`5.15.217`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[1a339b658d9dbe1471f67b78237cf8fa08bbbeb5,c9acbe38797bc1aa3c22a1ab72452e210af6e0ff)`	affected	code_commit	—
`[1a339b658d9dbe1471f67b78237cf8fa08bbbeb5,6b068a97958aa00a901a9b5083d74114b21f7b66)`	affected	code_commit	—
`[1a339b658d9dbe1471f67b78237cf8fa08bbbeb5,bb63a0530e8e6de3aaf29cd5ba487db2490128ef)`	affected	code_commit	—
`[1a339b658d9dbe1471f67b78237cf8fa08bbbeb5,ba33b4f9d3423accd2c91a0b0b0680cd589922f2)`	affected	code_commit	—
`[1a339b658d9dbe1471f67b78237cf8fa08bbbeb5,4bb3e1bc142dc9c3240ceed1b3ab031aa9cb1723)`	affected	code_commit	—
`[1a339b658d9dbe1471f67b78237cf8fa08bbbeb5,c0c9cfb3b75def8bf200a2d4db09015806acfeaf)`	affected	code_commit	—
`cd4ae0b05126cc9461a2e50ccb745e5583cc91e2`	affected	code_commit	—
`cf503dbe5c22c6ab9797e1cf864a11597d711c3a`	affected	code_commit	—
`d229e7ecc0cb29996688f0fa98c5eb6128b81e3a`	affected	code_commit	—
`[4.9.128,4.10)`	affected	semver	—
`[4.14.71,4.15)`	affected	semver	—
`[4.18.9,4.19)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`4.19`	affected	semver	—
`[0,4.19)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8887-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8888-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8889-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8887-2	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8888-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8887-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8917-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8918-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9003-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9043-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.216% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/45ceeb08bf1f4f7353ffb529d8682a0cf5506318
https://git.kernel.org/stable/c/4bb3e1bc142dc9c3240ceed1b3ab031aa9cb1723
https://git.kernel.org/stable/c/6b068a97958aa00a901a9b5083d74114b21f7b66
https://git.kernel.org/stable/c/ba33b4f9d3423accd2c91a0b0b0680cd589922f2
https://git.kernel.org/stable/c/bb63a0530e8e6de3aaf29cd5ba487db2490128ef
https://git.kernel.org/stable/c/c0c9cfb3b75def8bf200a2d4db09015806acfeaf
https://git.kernel.org/stable/c/c9acbe38797bc1aa3c22a1ab72452e210af6e0ff
https://git.kernel.org/stable/c/eef71c01deb08547956df3634a0d34c6bdbcecb8
https://lore.kernel.org/linux-cve-announce/2026081534-CVE-2026-72152-2462@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72152
https://www.cve.org/CVERecord?id=CVE-2026-72152

History

Nov 7, 2026 7:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 23, 2026 1:15 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/45ceeb08bf1f4f7353ffb529d8682a0cf5506318 https://git.kernel.org/stable/c/eef71c01deb08547956df3634a0d34c6bdbcecb8

Aug 22, 2026 10:45 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-703

Aug 19, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-821
References		https://lore.kernel.org/linux-cve-announce/2026081534-CVE-2026-72152-2462@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72152 https://www.cve.org/CVERecord?id=CVE-2026-72152
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Aug 15, 2026 9:45 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-703

Aug 15, 2026 6:00 AM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() wait_event_interruptible_timeout() evaluates its condition after setting the current task state to TASK_INTERRUPTIBLE. With CONFIG_DEBUG_ATOMIC_SLEEP this triggers a warning when the IRQ wait path is used: tpm_tis_status() tpm_tis_spi_read_bytes() tpm_tis_spi_transfer_full() spi_bus_lock() mutex_lock() Address this with the following measures: 1. Call wait_tpm_stat_cond() only while tasking is running. 2. Use wait_woken() to wait for changes.
Title		tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/4bb3e1bc142dc9c3240ceed1b3ab031aa9cb1723 https://git.kernel.org/stable/c/6b068a97958aa00a901a9b5083d74114b21f7b66 https://git.kernel.org/stable/c/ba33b4f9d3423accd2c91a0b0b0680cd589922f2 https://git.kernel.org/stable/c/bb63a0530e8e6de3aaf29cd5ba487db2490128ef https://git.kernel.org/stable/c/c0c9cfb3b75def8bf200a2d4db09015806acfeaf https://git.kernel.org/stable/c/c9acbe38797bc1aa3c22a1ab72452e210af6e0ff