{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2025-68792",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2025-12-24T10:30:51.037Z",
        "datePublished": "2026-01-13T15:29:04.226Z",
        "dateUpdated": "2026-08-05T12:11:28.554Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T12:11:28.554Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm2-sessions: Fix out of range indexing in name_size\n\n'name_size' does not have any range checks, and it just directly indexes\nwith TPM_ALG_ID, which could lead into memory corruption at worst.\n\nAddress the issue by only processing known values and returning -EINVAL for\nunrecognized values.\n\nMake also 'tpm_buf_append_name' and 'tpm_buf_fill_hmac_session' fallible so\nthat errors are detected before causing any spurious TPM traffic.\n\nEnd also the authorization session on failure in both of the functions, as\nthe session state would be then by definition corrupted."
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 7.8,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:L - An unprivileged process can reach the vulnerable parser through add_key trusted-key operations, which invoke TPM2_ReadPublic and session HMAC preparation; no physical access is required.\nAC:L - On an affected configuration with a compatible TPM or vTPM, the attacker controls the trusted-key creation and load sequence and can select an unsupported Name algorithm such as sm3-256 without a race or uncontrollable condition.\nPR:L - The add_key syscall and trusted-key instantiate path contain no capability check, and an ordinary user can target a writable user or process keyring.\nUI:N - Exploitation is initiated entirely by the attacker's syscalls and TPM command sequence without requiring another user to act.\nS:U - The vulnerable code and the affected kernel resources belong to the same host-kernel security authority; ordinary kernel privilege escalation does not change scope.\nC:H - The out-of-range table value becomes a length used for subsequent kernel-memory processing, enabling an out-of-bounds read and potential disclosure in the highest-severity reasonable layout.\nI:H - The attacker-influenced length reaches memcpy into the fixed-size authorization Name storage, permitting out-of-bounds writes and potentially exploitable kernel memory corruption.\nA:H - The invalid index and resulting out-of-bounds accesses can produce a kernel fault, KASAN panic, or corrupted session state, and the triggering operation can be repeated."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/char/tpm/tpm2-cmd.c",
                        "drivers/char/tpm/tpm2-sessions.c",
                        "include/linux/tpm.h",
                        "security/keys/trusted-keys/trusted_tpm2.c"
                    ],
                    "versions": [
                        {
                            "version": "1085b8276bb4239daa7008f0dcd5c973e4bd690f",
                            "lessThan": "47e676ce4d68f461dfcab906f6aeb254f7276deb",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "1085b8276bb4239daa7008f0dcd5c973e4bd690f",
                            "lessThan": "04a3aa6e8c5f878cc51a8a1c90b6d3c54079bc43",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "1085b8276bb4239daa7008f0dcd5c973e4bd690f",
                            "lessThan": "6e9722e9a7bfe1bbad649937c811076acf86e1fd",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "drivers/char/tpm/tpm2-cmd.c",
                        "drivers/char/tpm/tpm2-sessions.c",
                        "include/linux/tpm.h",
                        "security/keys/trusted-keys/trusted_tpm2.c"
                    ],
                    "versions": [
                        {
                            "version": "6.10",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.10",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.12.66",
                            "lessThanOrEqual": "6.12.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.18.3",
                            "lessThanOrEqual": "6.18.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.19",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.10",
                                    "versionEndExcluding": "6.12.66"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.10",
                                    "versionEndExcluding": "6.18.3"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.10",
                                    "versionEndExcluding": "6.19"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/47e676ce4d68f461dfcab906f6aeb254f7276deb"
                },
                {
                    "url": "https://git.kernel.org/stable/c/04a3aa6e8c5f878cc51a8a1c90b6d3c54079bc43"
                },
                {
                    "url": "https://git.kernel.org/stable/c/6e9722e9a7bfe1bbad649937c811076acf86e1fd"
                }
            ],
            "title": "tpm2-sessions: Fix out of range indexing in name_size",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        }
    }
}