---
id: "CVE-2026-99221"
kind: "vulnerability"
aliases: ["CVE-2026-99221"]
title: "Linux kernel: trusted keys can instantiate after a failed TPM unseal"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "linux-kernel", "tpm", "trusted-keys"]
not_affected_if: ["no-tpm", "no-trusted-keys"]
published_at: "2026-11-02T16:17:46+00:00"
first_seen_at: "2026-11-02T16:24:05+00:00"
updated_at: "2026-11-02T16:27:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99221", "first_seen_at": "2026-11-02T16:24:05+00:00"}]
---

# Linux kernel: trusted keys can instantiate after a failed TPM unseal

When unsealing a trusted key from a TPM fails, the kernel's trusted_keys code keeps going and a later pcrlock check can overwrite the error, so key creation reports success. The sources do not describe what an attacker gains beyond a key being instantiated when it should have been rejected.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running kernel version with `uname -r` and compare it to the fixed releases in the NVD entry.
- Check whether trusted keys are in use, e.g. `grep -r trusted /proc/keys` or `cat /proc/keys` for entries of type trusted.

## Timeline

- 2026-11-02T16:24:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99221

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

keys/trusted_keys: return immediately after TPM unseal failure

trusted_tpm_unseal() proceeds to pcrlock() when the TPM unseal operation
fails. If pcrlock() succeeds, its return value overwrites the unseal error,
causing key instantiation to succeed.

Return immediately when unseal fails to preserve the original error.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_