A flaw in the Linux kernel’s TPM2 session code allows an asynchronous key‑pair‑generation request to be freed before the operation completes. The freed request is later accessed by a completion worker, which can corrupt kernel memory. This kind of kernel memory corruption may lead to a denial‑of‑service. The weakness is a classic use‑after‑free scenario, as the code discards the return value of the cryptographic request and does not set a completion callback.

All Linux kernel builds that employ TPM2 session functionality are affected. The vulnerability exists at the driver level (drivers/char/tpm/tpm2‑sessions.c) and triggers automatically during entropy collection, so any system running a kernel with this code path is impacted, regardless of vendor.

The vulnerability is not listed in CISA’s KEV catalog, the EPSS score is <1%, and the CVSS score is 8.4. Nevertheless, the attack path is in kernel space and is triggered by normal kernel activity rather than a user‑initiated request, implying a low to moderate likelihood of accidental exploitation. Based on the description, the likely attack vector is inferred to be a kernel‑level exploitation that is automatically triggered during entropy collection, without userland input. Compromise of the system requires that the attacker can influence the kernel’s TPM subsystem, which is typically restricted to privileged code. The risk is therefore primarily of denial‑of‑service or crash. The kernel developers have addressed the issue by installing a proper completion callback and waiting for request completion before freeing the request object.