In the Linux kernel TPM st33zp24 driver, the get_burstcount function can return a busy error on timeout. When this occurs, the driver fails to release the locality that was previously acquired, leaving it locked. This incomplete cleanup stalls subsequent TPM requests, potentially disabling authentication, secure boot, or any application that relies on TPM services. The weakness is a lack of proper error handling and cleanup, which can lead to a denial of service for the affected host.

The bug is present in all Linux kernel releases that ship the st33zp24 TPM driver before the patch referenced in commit 1256c6dc. It affects any distribution that includes this driver in its kernel image, regardless of version, as the issue is not tied to a specific kernel release but to the presence of the faulty code path. System administrators should confirm whether their running kernel contains the st33zp24 driver and whether it predates the described fix.

The CVSS score is not provided, and the EPSS score is unavailable; the vulnerability is not listed in CISA's KEV catalog. The flaw requires a local error condition – a busy timeout in get_burstcount – making remote exploitation unlikely. An attacker with local privileges could trigger TPM command timeouts to lock the locality, leading to a denial of service that affects system authentication or cryptographic operations. The overall risk is moderate, with a typical attack vector being local privilege or service exploitation rather than remote network attacks.