The vulnerability stems from the TPM driver using plain memory deallocation for the authentication session structure, leaving cryptographic material such as HMAC keys, nonces and passphrase data in memory that has only been freed, not zeroed. This exposure allows other processes or code that gains read‑only access to kernel memory to read the residual data, potentially compromising the secrecy and integrity of the authentication session. Based on the description, it is inferred that an attacker requires local kernel or privileged access to read this residual data.

All Linux kernel releases that include the TPM driver and have not yet applied the patch. The affected product is the Linux kernel, with changes introduced in the kernel source commit referenced in the advisory. No specific version numbers are provided, so any kernel version running the unpatched TPM driver is potentially vulnerable.

The CVSS score is 5.5, and the EPSS score is < 1%, indicating a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The risk is primarily data exfiltration of session keys which could be leveraged by a local attacker with kernel or privileged access to read the residual data before it is overwritten. Since the condition involves memory that is ultimately freed, successful exploitation would depend on timing and optimal memory layout. The likely attack vector, based on the description, is a local attacker with kernel or privileged access to read the freed memory before it is overwritten. The overall risk is moderate to high for systems in which the TPM driver is used and the attacker can obtain kernel exploitation, but remote exploitation is unlikely without additional kernel vulnerabilities.