CVE-2026-98728

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98728", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.366Z", "datePublished": "2026-10-18T15:47:05.722Z", "dateUpdated": "2026-10-19T09:24:38.853Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:24:38.853Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: fix off-by-four bounds check in tpm2_get_random()\n\nWhen the response carries the TPM2_ST_SESSIONS tag, tpm2_get_random()\nskips the 4-byte parameter size field before locating the random data,\nbut the bounds check still validates the response length against\nTPM_HEADER_SIZE. A truncated response can pass the check and make\nmemcpy() read up to 4 bytes past the response end, so stale buffer\ncontents end up in the caller's random bytes.\n\nFix this by checking the response length against 'offset', which\nalready includes the skipped parameter size field."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/char/tpm/tpm2-cmd.c"], "versions": [{"version": "1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497", "lessThan": "be54101992c2c5218be0e0a87827ccc96e3089af", "status": "affected", "versionType": "git"}, {"version": "1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497", "lessThan": "e30a2406408d2df6d9cd48c2e59e913cf266a05a", "status": "affected", "versionType": "git"}, {"version": "1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497", "lessThan": "42bb6216b861e892512128219ff23010d656ba14", "status": "affected", "versionType": "git"}, {"version": "1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497", "lessThan": "9b522400bf5c082feb9a0037a053ea822a2c7e4d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/char/tpm/tpm2-cmd.c"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/be54101992c2c5218be0e0a87827ccc96e3089af"}, {"url": "https://git.kernel.org/stable/c/e30a2406408d2df6d9cd48c2e59e913cf266a05a"}, {"url": "https://git.kernel.org/stable/c/42bb6216b861e892512128219ff23010d656ba14"}, {"url": "https://git.kernel.org/stable/c/9b522400bf5c082feb9a0037a053ea822a2c7e4d"}], "title": "tpm: fix off-by-four bounds check in tpm2_get_random()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/char/tpm/tpm2-cmd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "be54101992c2c5218be0e0a87827ccc96e3089af", "status": "affected", "version": "1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497", "versionType": "git"}, {"lessThan": "e30a2406408d2df6d9cd48c2e59e913cf266a05a", "status": "affected", "version": "1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497", "versionType": "git"}, {"lessThan": "42bb6216b861e892512128219ff23010d656ba14", "status": "affected", "version": "1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497", "versionType": "git"}, {"lessThan": "9b522400bf5c082feb9a0037a053ea822a2c7e4d", "status": "affected", "version": "1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/char/tpm/tpm2-cmd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: fix off-by-four bounds check in tpm2_get_random()\n\nWhen the response carries the TPM2_ST_SESSIONS tag, tpm2_get_random()\nskips the 4-byte parameter size field before locating the random data,\nbut the bounds check still validates the response length against\nTPM_HEADER_SIZE. A truncated response can pass the check and make\nmemcpy() read up to 4 bytes past the response end, so stale buffer\ncontents end up in the caller's random bytes.\n\nFix this by checking the response length against 'offset', which\nalready includes the skipped parameter size field."}], "id": "CVE-2026-98728", "lastModified": "2026-10-19T10:19:36.963", "metrics": {}, "published": "2026-10-18T16:17:26.430", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/42bb6216b861e892512128219ff23010d656ba14"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9b522400bf5c082feb9a0037a053ea822a2c7e4d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/be54101992c2c5218be0e0a87827ccc96e3089af"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e30a2406408d2df6d9cd48c2e59e913cf266a05a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: tpm: fix off-by-four bounds check in tpm2_get_random()", "id": "2555107", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555107"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ntpm: fix off-by-four bounds check in tpm2_get_random()\nWhen the response carries the TPM2_ST_SESSIONS tag, tpm2_get_random()\nskips the 4-byte parameter size field before locating the random data,\nbut the bounds check still validates the response length against\nTPM_HEADER_SIZE. A truncated response can pass the check and make\nmemcpy() read up to 4 bytes past the response end, so stale buffer\ncontents end up in the caller's random bytes.\nFix this by checking the response length against 'offset', which\nalready includes the skipped parameter size field.", "A flaw was found in the Linux kernel's Trusted Platform Module (TPM) driver. This flaw can lead to information disclosure when the kernel requests random data. Due to an incorrect bounds check when processing session-tagged responses, a truncated response can pass validation and cause the kernel to read past the end of the buffer. Consequently, stale kernel memory contents may be returned to the caller instead of random data, potentially exposing sensitive information."], "name": "CVE-2026-98728", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98728\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98728\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98728.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497,be54101992c2c5218be0e0a87827ccc96e3089af)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497,e30a2406408d2df6d9cd48c2e59e913cf266a05a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497,42bb6216b861e892512128219ff23010d656ba14)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497,9b522400bf5c082feb9a0037a053ea822a2c7e4d)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T22:15:14.437671+00:00", "updated": "2026-10-23T22:15:17.038152+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}