---
id: "CVE-2026-98728"
kind: "vulnerability"
aliases: ["CVE-2026-98728"]
title: "Linux kernel TPM driver: off-by-four check leaks stale memory into random bytes"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["linux-kernel", "runtime", "self-hosted", "tpm"]
not_affected_if: ["no-tpm-hardware"]
published_at: "2026-10-18T16:17:26+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:17:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98728", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel TPM driver: off-by-four check leaks stale memory into random bytes

The Linux kernel's TPM random-number path checks the response length against the wrong offset, so a truncated TPM response lets memcpy() read up to 4 bytes past the buffer end. The stale bytes end up in the random data handed to the caller.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Update to a Linux kernel release that includes the tpm2_get_random() bounds-check fix (version unknown from sources)

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98728

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

tpm: fix off-by-four bounds check in tpm2_get_random()

When the response carries the TPM2_ST_SESSIONS tag, tpm2_get_random()
skips the 4-byte parameter size field before locating the random data,
but the bounds check still validates the response length against
TPM_HEADER_SIZE.  A truncated response can pass the check and make
memcpy() read up to 4 bytes past the response end, so stale buffer
contents end up in the caller's random bytes.

Fix this by checking the response length against 'offset', which
already includes the skipped parameter size field.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_