Linux Kernel Vulnerability in Trusted Key Management

CVE-2026-89763

What is CVE-2026-89763?

A vulnerability in the Linux kernel's trusted key management system allows for a use-after-free condition during the teardown of the TPM (Trusted Platform Module) subsystem. The issue arises from an improper ordering in the cleanup process, where the TPM reference and associated digest array are released before the trusted key type is unregistered. This flaw can lead to dereferencing a freed memory space during key operations, posing a risk of unauthorized memory access and stability issues. The vulnerability has been addressed by rearranging the teardown sequence to ensure all key operations are completed before freeing resources.

References