The vulnerability stems from the TPM driver using plain memory deallocation for the authentication session structure, leaving cryptographic material such as HMAC keys, nonces and passphrase data in memory that has only been freed, not zeroed. This exposure allows other processes or code that gains read‑only access to kernel memory to read the residual data, potentially compromising the secrecy and integrity of the authentication session.

All Linux kernel releases that include the TPM driver and have not yet applied the patch. The affected product is the Linux kernel, with changes introduced in the kernel source commit referenced in the advisory. No specific version numbers are provided, so any kernel version running the unpatched TPM driver is potentially vulnerable.

The CVSS score is 5.5, and EPSS data is unavailable, but the vulnerability is listed as not in the CISA KEV catalog. The risk is primarily data exfiltration of session keys which could be leveraged by a local attacker with kernel or privileged access to read the residual data before it is overwritten. The attack vector is therefore likely local, requiring the attacker to already have the capability to access kernel memory. Since the condition involves memory that is ultimately freed, successful exploitation would depend on timing and optimal memory layout. The overall risk is moderate to high for systems in which the TPM driver is used and the attacker can obtain kernel exploitation, but remote exploitation is unlikely without additional kernel vulnerabilities.