CVE-2026-89763: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-89763 is a use-after-free vulnerability in the Linux kernel's KEYS trusted subsystem caused by incorrect TPM teardown ordering. The trusted_tpm_exit() function drops the TPM chip reference and frees the digest array before calling unregister_key_type(), creating a race condition where concurrent key operations can dereference freed memory. It affects Linux kernel versions from 5.1 up to (but not including) the patched commits in the 6.18 and 7.2 stable series. The vulnerability is classified as Medium severity (CWE-825: Expired Pointer Dereference) (Red Hat Advisory, GitHub Advisory).

The root cause is an incorrect teardown sequence in trusted_tpm_exit() (CWE-825: Expired Pointer Dereference). The function releases the TPM chip reference (put_device(&chip->dev)) and frees the digest array (kfree(digests)) before calling unregister_key_type(). Because key_type_lookup() holds key_types_sem for reading until a key operation completes, and unregister_key_type() acquires it for writing, the unregister call is the correct synchronization barrier — but it arrives too late. This permits a concurrent CPU to enter trusted_tpm_seal() → pcrlock() → tpm_pcr_extend() and read from the already-freed digest array. KASAN confirmed the bug as a slab-use-after-free at tpm_pcr_extend+0x1f0/0x200 (GitHub Advisory, Red Hat Advisory).

A local user with permission to create or instantiate trusted keys can trigger this vulnerability during concurrent key operations while the trusted kernel module is being unloaded, resulting in a use-after-free memory access. Successful exploitation can lead to arbitrary kernel code execution or a kernel panic (denial of service). The impact is confined to the local system; however, kernel-level code execution could allow full privilege escalation and system compromise (Red Hat Advisory, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Red Hat Advisory). Exploitation requires local access and the ability to create trusted keys, limiting the attack surface. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no EPSS score or threat actor attribution is currently available (GitHub Advisory).

1. Gain local access: Obtain a local account on a Linux system running kernel 5.1 or later with TPM support and the trusted key type module loaded.
2. Prepare concurrent key creation: Write a program (or use the keyctl utility) that continuously calls add_key("trusted", ...) to instantiate trusted keys, triggering trusted_tpm_seal() → pcrlock() → tpm_pcr_extend() in a tight loop.
3. Trigger module unload: Simultaneously, unload the trusted kernel module (e.g., rmmod trusted) from another thread or process to invoke trusted_tpm_exit().
4. Race the teardown: The race window opens when trusted_tpm_exit() calls kfree(digests) before unregister_key_type() completes. If the concurrent key operation reaches tpm_pcr_extend() after the free, it dereferences the freed digest array.
5. Achieve kernel impact: The use-after-free can result in a kernel crash (denial of service) or, with careful heap manipulation, arbitrary kernel code execution and privilege escalation (GitHub Advisory).

• Logs: Kernel logs (dmesg / /var/log/kern.log) containing BUG: KASAN: slab-use-after-free in tpm_pcr_extend or similar KASAN reports.
• Logs: Kernel oops or panic traces referencing tpm_pcr_extend, pcrlock, trusted_tpm_seal, trusted_instantiate, or __key_create_or_update in the call stack.
• Process: Repeated invocations of keyctl or custom binaries calling add_key with type trusted from a non-privileged user account, especially concurrent with rmmod trusted.
• File System: Presence of a proof-of-concept binary named poc (as referenced in the KASAN trace: task poc/89) in unexpected directories.

Apply the upstream kernel patches that reorder trusted_tpm_exit() to call unregister_key_type() before releasing the TPM chip reference or freeing the digest array. The fix is available in stable commits 753c978f2400f9783eb524842a975d3ac950d511, 2f7541afbc57fe9d26769a22c31d8ce8790c9a19, and 5e2d672280d97d83de43031d93761b12dadd7b8a. Patched kernel versions include 6.18.50+ and 7.2.4+; update to these versions when available from your Linux distribution. As a temporary workaround, avoid unloading the trusted module on systems where concurrent trusted key operations are occurring (GitHub Advisory, Red Hat Advisory).