CVE-2026-99221

Description

A flaw was found in the Linux kernel's trusted keys subsystem. During the process of unsealing a key using a Trusted Platform Module (TPM), the kernel fails to abort if the unseal operation fails, allowing a subsequent locking operation to overwrite the failure status with a success code. A local user could exploit this flaw to instantiate trusted keys despite unsealing failures, potentially bypassing security controls.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score3.3N/AN/A
Attack VectorLocalN/AN/A
Attack ComplexityLowN/AN/A
Privileges RequiredLowN/AN/A
User InteractionNoneN/AN/A
ScopeUnchangedN/AN/A
ConfidentialityNoneN/AN/A
Integrity ImpactLowN/AN/A
Availability ImpactNoneN/AN/A

Vector

Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Understanding the Weakness (CWE)

CWE-393

Integrity,Other

Technical Impact: Unexpected State; Alter Execution Logic

This weakness can lead to unpredictable behavior. If the function is used to make security-critical decisions or provide security-critical information, then the wrong status code can cause the product to assume that an action is safe or correct, even when it is not. This weakness could place the system in a state that could lead unexpected logic to be executed or other unintended behaviors.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.