CVE-2025-68792

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-68792", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-24T10:30:51.037Z", "datePublished": "2026-01-13T15:29:04.226Z", "dateUpdated": "2026-08-05T12:11:28.554Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:11:28.554Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm2-sessions: Fix out of range indexing in name_size\n\n'name_size' does not have any range checks, and it just directly indexes\nwith TPM_ALG_ID, which could lead into memory corruption at worst.\n\nAddress the issue by only processing known values and returning -EINVAL for\nunrecognized values.\n\nMake also 'tpm_buf_append_name' and 'tpm_buf_fill_hmac_session' fallible so\nthat errors are detected before causing any spurious TPM traffic.\n\nEnd also the authorization session on failure in both of the functions, as\nthe session state would be then by definition corrupted."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - An unprivileged process can reach the vulnerable parser through add_key trusted-key operations, which invoke TPM2_ReadPublic and session HMAC preparation; no physical access is required.\nAC:L - On an affected configuration with a compatible TPM or vTPM, the attacker controls the trusted-key creation and load sequence and can select an unsupported Name algorithm such as sm3-256 without a race or uncontrollable condition.\nPR:L - The add_key syscall and trusted-key instantiate path contain no capability check, and an ordinary user can target a writable user or process keyring.\nUI:N - Exploitation is initiated entirely by the attacker's syscalls and TPM command sequence without requiring another user to act.\nS:U - The vulnerable code and the affected kernel resources belong to the same host-kernel security authority; ordinary kernel privilege escalation does not change scope.\nC:H - The out-of-range table value becomes a length used for subsequent kernel-memory processing, enabling an out-of-bounds read and potential disclosure in the highest-severity reasonable layout.\nI:H - The attacker-influenced length reaches memcpy into the fixed-size authorization Name storage, permitting out-of-bounds writes and potentially exploitable kernel memory corruption.\nA:H - The invalid index and resulting out-of-bounds accesses can produce a kernel fault, KASAN panic, or corrupted session state, and the triggering operation can be repeated."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/char/tpm/tpm2-cmd.c", "drivers/char/tpm/tpm2-sessions.c", "include/linux/tpm.h", "security/keys/trusted-keys/trusted_tpm2.c"], "versions": [{"version": "1085b8276bb4239daa7008f0dcd5c973e4bd690f", "lessThan": "47e676ce4d68f461dfcab906f6aeb254f7276deb", "status": "affected", "versionType": "git"}, {"version": "1085b8276bb4239daa7008f0dcd5c973e4bd690f", "lessThan": "04a3aa6e8c5f878cc51a8a1c90b6d3c54079bc43", "status": "affected", "versionType": "git"}, {"version": "1085b8276bb4239daa7008f0dcd5c973e4bd690f", "lessThan": "6e9722e9a7bfe1bbad649937c811076acf86e1fd", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/char/tpm/tpm2-cmd.c", "drivers/char/tpm/tpm2-sessions.c", "include/linux/tpm.h", "security/keys/trusted-keys/trusted_tpm2.c"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.66", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.3", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.66"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.18.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/47e676ce4d68f461dfcab906f6aeb254f7276deb"}, {"url": "https://git.kernel.org/stable/c/04a3aa6e8c5f878cc51a8a1c90b6d3c54079bc43"}, {"url": "https://git.kernel.org/stable/c/6e9722e9a7bfe1bbad649937c811076acf86e1fd"}], "title": "tpm2-sessions: Fix out of range indexing in name_size", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/char/tpm/tpm2-cmd.c", "drivers/char/tpm/tpm2-sessions.c", "include/linux/tpm.h", "security/keys/trusted-keys/trusted_tpm2.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "47e676ce4d68f461dfcab906f6aeb254f7276deb", "status": "affected", "version": "1085b8276bb4239daa7008f0dcd5c973e4bd690f", "versionType": "git"}, {"lessThan": "04a3aa6e8c5f878cc51a8a1c90b6d3c54079bc43", "status": "affected", "version": "1085b8276bb4239daa7008f0dcd5c973e4bd690f", "versionType": "git"}, {"lessThan": "6e9722e9a7bfe1bbad649937c811076acf86e1fd", "status": "affected", "version": "1085b8276bb4239daa7008f0dcd5c973e4bd690f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/char/tpm/tpm2-cmd.c", "drivers/char/tpm/tpm2-sessions.c", "include/linux/tpm.h", "security/keys/trusted-keys/trusted_tpm2.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.66", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm2-sessions: Fix out of range indexing in name_size\n\n'name_size' does not have any range checks, and it just directly indexes\nwith TPM_ALG_ID, which could lead into memory corruption at worst.\n\nAddress the issue by only processing known values and returning -EINVAL for\nunrecognized values.\n\nMake also 'tpm_buf_append_name' and 'tpm_buf_fill_hmac_session' fallible so\nthat errors are detected before causing any spurious TPM traffic.\n\nEnd also the authorization session on failure in both of the functions, as\nthe session state would be then by definition corrupted."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ntpm2-sessions: Correcci\u00f3n de indexaci\u00f3n fuera de rango en name_size\n\n'name_size' no tiene ninguna comprobaci\u00f3n de rango, y simplemente indexa directamente con TPM_ALG_ID, lo que podr\u00eda llevar a corrupci\u00f3n de memoria en el peor de los casos.\n\nAbordar el problema procesando solo valores conocidos y devolviendo -EINVAL para valores no reconocidos.\n\nHacer tambi\u00e9n 'tpm_buf_append_name' y 'tpm_buf_fill_hmac_session' falibles para que los errores sean detectados antes de causar cualquier tr\u00e1fico TPM espurio.\n\nFinalizar tambi\u00e9n la sesi\u00f3n de autorizaci\u00f3n en caso de fallo en ambas funciones, ya que el estado de la sesi\u00f3n estar\u00eda entonces por definici\u00f3n corrupto."}], "id": "CVE-2025-68792", "lastModified": "2026-07-30T06:24:44.653", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-01-13T16:16:01.090", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/04a3aa6e8c5f878cc51a8a1c90b6d3c54079bc43"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/47e676ce4d68f461dfcab906f6aeb254f7276deb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6e9722e9a7bfe1bbad649937c811076acf86e1fd"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: tpm2-sessions: Fix out of range indexing in name_size", "id": "2429088", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429088"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\ntpm2-sessions: Fix out of range indexing in name_size\n'name_size' does not have any range checks, and it just directly indexes\nwith TPM_ALG_ID, which could lead into memory corruption at worst.\nAddress the issue by only processing known values and returning -EINVAL for\nunrecognized values.\nMake also 'tpm_buf_append_name' and 'tpm_buf_fill_hmac_session' fallible so\nthat errors are detected before causing any spurious TPM traffic.\nEnd also the authorization session on failure in both of the functions, as\nthe session state would be then by definition corrupted."], "name": "CVE-2025-68792", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-01-13T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-68792\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-68792\nhttps://lore.kernel.org/linux-cve-announce/2026011305-CVE-2025-68792-9a3f@gregkh/T"], "threat_severity": "Low"}

{}