The vulnerability arises when the TPM null key name integrity check fails. The system logs a warning, but it does not disable the TPM chip as intended. Because the load function returns 0 despite the mismatch, the caller receives an uninitialized key handle and proceeds to use it for authentication sessions. This allows an attacker to continue interacting with the TPM after an integrity violation, potentially forging sessions or bypassing trusted operations.

Affected systems are Linux kernel environments that use the TPM 2.0 driver with the CONFIG_TCG_TPM2_HMAC setting and support null key handling, such as QEMU with swtpm. Any system that loads the kernel module for TPM and has the null key mechanism enabled is vulnerable until the kernel patch is applied.

Based on the description, it is inferred that an attacker who can trigger a null key integrity failure may be able to bypass the intended disabling of the device. For example, by manipulating key names or sending malformed TPM commands, the integrity check fails while the TPM remains active. The likely attack vector is local, requiring access to the TPM driver or local user privileges, and could be leveraged for privilege escalation or fraud. The EPSS score of less than 1% indicates a very low probability of exploitation, and the issue is not yet included in the CISA KEV catalog. The CVSS score of 4.5 indicates moderate severity, reflecting the risk of misusing the TPM’s integrity model.