CVE-2026-98845: tpm: Disable TPM on null key name mismatch

CVE-2026-98845: tpm: Disable TPM on null key name mismatch

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

tpm: Disable TPM on null key name mismatch

The null key name check exists to protect against TPM reset attacks, so
a mismatch should stop the device from serving further requests.
Currently it does not disable the chip when it finds a mismatch.

The mismatch is logged:

    tpm tpm0: null key integrity check failed

but the chip keeps serving commands:

    / # tpm2_getcap -c properties-fixed
    TPM_PT_FAMILY_INDICATOR:
      as UINT32:                0x08322e3000
      as string:                "2.0"
    ...

tpm2_load_null() where the null key name check is run sets the chip as
disabled only if the rc is non zero. When the mismatch is seen, rc is
zero at that point and it returns success. The other issue is that the
caller expects the null key handle to be populated when the function
returns 0 which it does here without writing the handle and proceeds
assuming the null key handle is valid.

During the test, I noticed that tpm2_start_auth_session() uses the
uninitialized stack value as the key handle since tpm2_load_null()
returns 0 despite the integrity failure and proceeds with
TPM2_CC_START_AUTH_SESS with this value as salt key handle.

Set rc to -ENODEV on the mismatch. The error path then disables the chip
and returns the correct code to the caller.

Tested in QEMU with swtpm and CONFIG_TCG_TPM2_HMAC=y by making
TPM2_CC_CONTEXT_LOAD fail with TPM2_RC_INTEGRITY and changing the name
of the re-created null key. The chip is now disabled on the mismatch.

The Linux kernel CVE team has assigned CVE-2026-98845 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.12 with commit cc7d8594342a25693d40fe96f97e5c6c29ee609c and fixed in 6.12.113 with commit a03d0c64cd827a622578623a78defd66b6593b82
	Issue introduced in 6.12 with commit cc7d8594342a25693d40fe96f97e5c6c29ee609c and fixed in 6.18.56 with commit 96c46c75b0d470b4204f9fe1bdb075cd2ebaebfa
	Issue introduced in 6.12 with commit cc7d8594342a25693d40fe96f97e5c6c29ee609c and fixed in 7.2.10 with commit f6599d8830fe7ddab7334cc17846fd9ac9a7fa50
	Issue introduced in 6.12 with commit cc7d8594342a25693d40fe96f97e5c6c29ee609c and fixed in 7.3-rc6 with commit 015fb29a748342a186f37b602ac70017098c8251
	Issue introduced in 6.11.7 with commit 294984ce51c19c2af3d0d71e1c8bd589bc86b8e2
	Issue introduced in 6.11.10 with commit 386c7cc6c06d64cbf36d15c5e2319814765e107c

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-98845
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/char/tpm/tpm2-sessions.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/a03d0c64cd827a622578623a78defd66b6593b82
	https://git.kernel.org/stable/c/96c46c75b0d470b4204f9fe1bdb075cd2ebaebfa
	https://git.kernel.org/stable/c/f6599d8830fe7ddab7334cc17846fd9ac9a7fa50
	https://git.kernel.org/stable/c/015fb29a748342a186f37b602ac70017098c8251