The weakness is in the Linux kernel's trusted key subsystem. During a TPM unseal operation the trusted_tpm_unseal() routine ignores the initial error and calls pcrlock(). If pcrlock() succeeds, its success code overwrites the original failure, making the key creation appear successful. This flaw allows a key to be instantiated when the TPM provides corrupted or missing data, potentially giving an attacker unauthorized access to resources protected by that key.

The bug exists in the Linux kernel itself with no specific version range given in the CNA data. The code path is exercised whenever a trusted key is instantiated using TPM integration. Any system running a kernel that has not yet incorporated the kernel commit that restores the error handling is affected, including recent mainline releases prior to the patch of the trusted_tpm_unseal path.

The CVSS, EPSS, or KEV metrics are not provided, so the quantitative risk is unknown. The vulnerability is not listed in the CISA KEV catalog. Because the flaw requires local control over TPM operations and execution of trusted key instantiation, the attack is limited to systems with local access. The exploit would need to trigger a TPM unseal failure that still allows a subsequent pcrlock success. In light of the lack of public exploits and the local nature of the attack, the current risk is considered moderate pending a patch.