{"id":"CVE-2026-98728","title":"tpm: fix off-by-four bounds check in tpm2_get_random()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: fix off-by-four bounds check in tpm2_get_random()\n\nWhen the response carries the TPM2_ST_SESSIONS tag, tpm2_get_random()\nskips the 4-byte parameter size field befo…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497 < be54101992c2c5218be0e0a87827ccc96e3089af","Linux >= 1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497 < e30a2406408d2df6d9cd48c2e59e913cf266a05a","Linux >= 1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497 < 42bb6216b861e892512128219ff23010d656ba14","Linux >= 1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497 < 9b522400bf5c082feb9a0037a053ea822a2c7e4d","Linux 6.10"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T15:47:05.722Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98728","references":[{"url":"https://git.kernel.org/stable/c/be54101992c2c5218be0e0a87827ccc96e3089af"},{"url":"https://git.kernel.org/stable/c/e30a2406408d2df6d9cd48c2e59e913cf266a05a"},{"url":"https://git.kernel.org/stable/c/42bb6216b861e892512128219ff23010d656ba14"},{"url":"https://git.kernel.org/stable/c/9b522400bf5c082feb9a0037a053ea822a2c7e4d"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T16:47:32.507Z","slug":"CVE-2026-98728","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntpm: fix off-by-four bounds check in tpm2_get_random()\n\nWhen the response carries the TPM2_ST_SESSIONS tag, tpm2_get_random()\nskips the 4-byte parameter size field before locating the random data,\nbut the bounds check still validates the response length against\nTPM_HEADER_SIZE.  A truncated response can pass the check and make\nmemcpy() read up to 4 bytes past the response end, so stale buffer\ncontents end up in the caller's random bytes.\n\nFix this by checking the response length against 'offset', which\nalready includes the skipped parameter size field.\n\n## Affected\n\n- `Linux >= 1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497 < be54101992c2c5218be0e0a87827ccc96e3089af`\n- `Linux >= 1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497 < e30a2406408d2df6d9cd48c2e59e913cf266a05a`\n- `Linux >= 1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497 < 42bb6216b861e892512128219ff23010d656ba14`\n- `Linux >= 1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497 < 9b522400bf5c082feb9a0037a053ea822a2c7e4d`\n- `Linux 6.10`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}