In the Linux kernel, the TPM2 driver contains an off‑by‑four bounds check in the tpm2_get_random() routine. When a response bearing the TPM2_ST_SESSIONS tag is processed, the driver skips the 4‑byte parameter size field before locating the random data, yet the bounds check still validates the response length against TPM_HEADER_SIZE. A truncated response can therefore pass the check and cause a memcpy() to read up to four bytes past the end of the actually received buffer, resulting in stale kernel memory being returned as random data. This flaw constitutes a buffer over‑read (CWE‑125) that can inadvertently leak information stored in the kernel stack or surrounding memory.

All Linux kernel distributions that ship the unpatched TPM2 driver are susceptible. The vulnerability is independent of distribution; any kernel built from a source tree prior to the commit that introduced the valid bounds check is affected. Administrators must verify whether the implicated commit is present in their current kernel build, as the advisory does not list a specific kernel version.

The EPSS score is < 1%, indicating a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The CVSS score is 2.5, indicating low severity. The buffer over‑read may allow information disclosure, but it does not provide remote code execution or a denial‑of‑service on its own. The likely attack vector requires an attacker to supply a malformed TPM response to the kernel, implying either local privilege or control over TPM command exchange. This inference is based on the description of how the kernel processes TPM responses, as the advisory does not detail an explicit attack path.