CVE-2026-89763

The Linux kernel's trusted keys TPM backend contains a race-condition use-after-free in which trusted_tpm_exit() frees the digest array and drops the TPM chip reference before unregistering the 'trusted' key type, so key operations that are still in flight can use freed memory. A local attacker triggers it by racing an add_key() syscall (e.g., sealing a trusted key, which calls tpm_pcr_extend on the digest array) against unloading of the trusted keys module, as confirmed by a KASAN slab-use-after-free report in tpm_pcr_extend. Successful exploitation of the UAF can corrupt kernel memory, with the CVSS 3.1 score (7.8) reflecting high impact to confidentiality, integrity, and availability, though practical exploitation requires a narrow timing window and privileged module-unload activity on the same system. Affected systems are Linux machines whose kernels build the trusted keys TPM backend (CONFIG_TRUSTED_KEYS as a loadable module), particularly those actively using TPM-sealed trusted keys. No public proof of concept is known and the flaw is not in the CISA KEV catalog.

What to do: Apply the updated kernel from your distribution once the fix (reordering unregister_key_type() before releasing the TPM chip and digest array) is included, then reboot. As a mitigation, avoid unloading the trusted-keys module on live systems or set kernel.modules_disabled=1 on hardened hosts, and restrict local untrusted shell access. Watch logs/panic traces for KASAN use-after-free reports in tpm_pcr_extend or crashes in trusted_tpm_seal/pcrlock as indicators of attempted triggering.