{"id":"CVE-2025-71077","title":"tpm: Cap the number of PCR banks","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: Cap the number of PCR banks\n\ntpm2_get_pcr_allocation() does not cap any upper limit for the number of\nbanks. Cap the limit to eight banks so that out of bounds val…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= bcfff8384f6c4e6627676ef07ccad9cfacd67849 < 8ceee7288152bc121a6bf92997261838c78bfe06","Linux >= bcfff8384f6c4e6627676ef07ccad9cfacd67849 < 275c686f1e3cc056ec66c764489ec1fe1e51b950","Linux >= bcfff8384f6c4e6627676ef07ccad9cfacd67849 < ceb70d31da5671d298bad94ae6c20e4bbb800f96","Linux >= bcfff8384f6c4e6627676ef07ccad9cfacd67849 < d88481653d74d622d1d0d2c9bad845fc2cc6fd23","Linux >= bcfff8384f6c4e6627676ef07ccad9cfacd67849 < b69492161c056d36789aee42a87a33c18c8ed5e1","Linux >= bcfff8384f6c4e6627676ef07ccad9cfacd67849 < 858344bc9210bea9ab2bdc7e9e331ba84c164e50","Linux >= bcfff8384f6c4e6627676ef07ccad9cfacd67849 < faf07e611dfa464b201223a7253e9dc5ee0f3c9e","Linux 5.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-06-10T20:40:49.952084Z"},"published":"2026-01-13","updated":"2026-10-19","sourceUpdated":"2026-10-19T18:15:10.933Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-71077","references":[{"url":"https://git.kernel.org/stable/c/8ceee7288152bc121a6bf92997261838c78bfe06"},{"url":"https://git.kernel.org/stable/c/275c686f1e3cc056ec66c764489ec1fe1e51b950"},{"url":"https://git.kernel.org/stable/c/ceb70d31da5671d298bad94ae6c20e4bbb800f96"},{"url":"https://git.kernel.org/stable/c/d88481653d74d622d1d0d2c9bad845fc2cc6fd23"},{"url":"https://git.kernel.org/stable/c/b69492161c056d36789aee42a87a33c18c8ed5e1"},{"url":"https://git.kernel.org/stable/c/858344bc9210bea9ab2bdc7e9e331ba84c164e50"},{"url":"https://git.kernel.org/stable/c/faf07e611dfa464b201223a7253e9dc5ee0f3c9e"}],"tags":["cve.org"],"epss":0.00147,"epssPercentile":0.03529,"ingestedAt":"2026-10-19T18:35:50.139Z","slug":"CVE-2025-71077","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntpm: Cap the number of PCR banks\n\ntpm2_get_pcr_allocation() does not cap any upper limit for the number of\nbanks. Cap the limit to eight banks so that out of bounds values coming\nfrom external I/O cause on only limited harm.\n\n## Affected\n\n- `Linux >= bcfff8384f6c4e6627676ef07ccad9cfacd67849 < 8ceee7288152bc121a6bf92997261838c78bfe06`\n- `Linux >= bcfff8384f6c4e6627676ef07ccad9cfacd67849 < 275c686f1e3cc056ec66c764489ec1fe1e51b950`\n- `Linux >= bcfff8384f6c4e6627676ef07ccad9cfacd67849 < ceb70d31da5671d298bad94ae6c20e4bbb800f96`\n- `Linux >= bcfff8384f6c4e6627676ef07ccad9cfacd67849 < d88481653d74d622d1d0d2c9bad845fc2cc6fd23`\n- `Linux >= bcfff8384f6c4e6627676ef07ccad9cfacd67849 < b69492161c056d36789aee42a87a33c18c8ed5e1`\n- `Linux >= bcfff8384f6c4e6627676ef07ccad9cfacd67849 < 858344bc9210bea9ab2bdc7e9e331ba84c164e50`\n- `Linux >= bcfff8384f6c4e6627676ef07ccad9cfacd67849 < faf07e611dfa464b201223a7253e9dc5ee0f3c9e`\n- `Linux 5.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}