{"id":"CVE-2026-99221","kind":"vulnerability","aliases":["CVE-2026-99221"],"related":[],"title":"Linux kernel: trusted keys can instantiate after a failed TPM unseal","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nkeys/trusted_keys: return immediately after TPM unseal failure\n\ntrusted_tpm_unseal() proceeds to pcrlock() when the TPM unseal operation\nfails. If pcrlock() succeeds, its return value overwrites the unseal error,\ncausing key instantiation to succeed.\n\nReturn immediately when unseal fails to preserve the original error.","summary":"When unsealing a trusted key from a TPM fails, the kernel's trusted_keys code keeps going and a later pcrlock check can overwrite the error, so key creation reports success. The sources do not describe what an attacker gains beyond a key being instantiated when it should have been rejected.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","tpm","trusted-keys"],"not_affected_if":["no-tpm","no-trusted-keys"],"how_to_check":"- Check the running kernel version with `uname -r` and compare it to the fixed releases in the NVD entry.\n- Check whether trusted keys are in use, e.g. `grep -r trusted /proc/keys` or `cat /proc/keys` for entries of type trusted.","fix":null,"status":"open","published_at":"2026-11-02T16:17:46+00:00","first_seen_at":"2026-11-02T16:24:05+00:00","triaged_at":"2026-11-02T16:27:01+00:00","updated_at":"2026-11-02T16:27:01+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-02T16:27:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: trusted keys can instantiate after a failed TPM unseal","impact":"low","summary":"When unsealing a trusted key from a TPM fails, the kernel's trusted_keys code keeps going and a later pcrlock check can overwrite the error, so key creation reports success. The sources do not describe what an attacker gains beyond a key being instantiated when it should have been rejected.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","tpm","trusted-keys"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; key instantiation may succeed despite a failed TPM unseal","analyst_note":"Find the affected and fixed kernel version ranges and confirm the attacker precondition on the NVD or kernel.org commit page.","how_to_check":"- Check the running kernel version with `uname -r` and compare it to the fixed releases in the NVD entry.\n- Check whether trusted keys are in use, e.g. `grep -r trusted /proc/keys` or `cat /proc/keys` for entries of type trusted.\n- unknown for the exact affected version ranges, as the sources do not list them.","plain_action":"","needs_analyst":true,"not_affected_if":["no-trusted-keys","no-tpm"],"who_is_affected":"Only systems that use trusted keys sealed to a TPM are described as affected. The sources do not give the affected kernel version ranges or say how an attacker reaches the flawed path. Systems not using trusted keys are unlikely to be exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000716,"input_tokens":4163,"output_tokens":600,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99221':14A,17A 'attack':64B 'beyond':66B 'caus':116C 'check':47B 'code':40B 'creation':54B 'cve':12A,15A 'describ':61B 'error':51B,115C,130C 'fail':9A,34B,105C,125C 'failur':93C 'follow':82C 'gain':65B 'go':42B 'immedi':89C,122C 'infrastructur':18B 'instanti':6A,70B,118C 'keep':41B 'kernel':2A,21B,36B,80C 'key':4A,25B,30B,39B,53B,68B,117C 'keys/trusted_keys':87C 'later':45B 'linux':1A,20B,79C 'linux-kernel':19B 'oper':104C 'origin':129C 'overwrit':49B,112C 'pcrlock':46B,99C,107C 'preserv':127C 'proceed':97C 'reject':76B 'report':55B 'resolv':86C 'return':88C,110C,121C 'sourc':58B 'succeed':108C,120C 'success':56B 'tpm':10A,22B,33B,91C,95C,102C 'trust':3A,24B,29B,38B,94C 'trusted-key':23B 'unseal':11A,27B,92C,96C,103C,114C,124C 'valu':111C 'vulner':83C","nicknames":[],"mitigations":[],"who_affected":"Only systems that use trusted keys sealed to a TPM are described as affected. The sources do not give the affected kernel version ranges or say how an attacker reaches the flawed path. Systems not using trusted keys are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","linuxkernel","tpm","trustedkeys","unknown"],"first_public_at":"2026-11-02T16:17:46+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99221","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99221","severity":null,"published_at":"2026-11-02T16:17:46+00:00","modified_at":"2026-11-02T16:17:46+00:00","first_seen_at":"2026-11-02T16:24:05+00:00","fetched_at":"2026-11-02T16:24:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}