CVE-2026-89763

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trusted_tpm_exit() drops the TPM chip reference and frees the digest array before unregistering the trusted key type. key_type_lookup() holds key_types_sem for reading until the key operation finishes, while unregister_key_type() takes it for writing. It therefore provides the synchronization point that must precede backend teardown. The current order permits this interleaving: CPU 0 CPU 1 trusted_tpm_exit() key_type_lookup("trusted") put_device(&chip->dev) trusted_tpm_seal() kfree(digests) pcrlock() unregister_key_type() tpm_pcr_extend(..., digests) CPU 1 can consequently dereference the freed digest array. The chip can also be released before callbacks stop using it. KASAN reported: BUG: KASAN: slab-use-after-free in tpm_pcr_extend+0x1f0/0x200 Read of size 2 at addr ffff88810872d000 by task poc/89 Call Trace: tpm_pcr_extend+0x1f0/0x200 pcrlock+0x42/0x70 [trusted] trusted_tpm_seal+0x1b6/0x570 [trusted] trusted_instantiate+0x293/0x340 [trusted] __key_instantiate_and_link+0xb2/0x2b0 __key_create_or_update+0x61e/0xb50 __do_sys_add_key+0x1b8/0x310 Allocated by task 88: __kmalloc_noprof+0x1a7/0x490 do_one_initcall+0xa1/0x390 do_init_module+0x2df/0x840 Freed by task 90: kfree+0x131/0x3c0 trusted_tpm_exit+0x59/0xa0 [trusted] __do_sys_delete_module+0x346/0x510 Move unregister_key_type() before releasing either resource. This stops new lookups and waits for in-flight key operations to finish before the backend state is destroyed.

• https://git.kernel.org/stable/c/2f7541afbc57fe9d26769a22c31d8ce8790c9a19
• https://git.kernel.org/stable/c/3d67b4acbfc7af331d887a8efc04bef6573b8a7a
• https://git.kernel.org/stable/c/5e2d672280d97d83de43031d93761b12dadd7b8a
• https://git.kernel.org/stable/c/753c978f2400f9783eb524842a975d3ac950d511

Published

Sep 11, 2026

Last Modified

Sep 21, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-89758In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-89759In the Linux kernel, the following vulnerability has been re…
• CVE-2026-8976The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, N…4.3
• CVE-2026-89760In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-89761In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-89762In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-89764In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-89765In the Linux kernel, the following vulnerability has been re…
• CVE-2026-89766In the Linux kernel, the following vulnerability has been re…
• CVE-2026-89767In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-89768In the Linux kernel, the following vulnerability has been re…
• CVE-2026-89769In the Linux kernel, the following vulnerability has been re…7.4