We found a bug reachable in:
path security/keys/trusted-keys
crash out-of-bounds in tpm2_unseal_trusted()
commit 2709dd5ae32f ("Merge tag 'sched-urgent-2026-08-22' of
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip")
Config, environment, the sanitizer report and a C reproducer follow.
== Notes ===============================================================
If you patch the bug based on our artifacts, a tag would be
appreciated:
Reported-by: [email protected]
Everything in this mail is validated by the reproducer below.
We also hold an LLM-generated root-cause analysis and a candidate
patch. The patch passes an A/B test: the same reproducer panics the
unpatched kernel and runs clean on the patched one. Neither has had
human review, so both still require validation before you send or
apply them. Available on:
patch.diff https://bugs.sh/b/6a581c4284f721d4/patch.diff
report.md https://bugs.sh/b/6a581c4284f721d4/report.md
This is an open science project. The code and the full set of PoCs
are not public at this moment, as we intend to disclose our findings
in an ethical way.
Happy to test patches. Complaints and suggestions about our work
are welcome at:
[email protected]
== Environment =========================================================
Reproduced on 2709dd5ae32f ("Merge tag 'sched-urgent-2026-08-22' of
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip")
VM setup https://bugs.sh/b/6a581c4284f721d4/run.sh
config https://bugs.sh/b/6a581c4284f721d4/config.gz
poc https://bugs.sh/b/6a581c4284f721d4/repro.c
== Sanitizer Report ====================================================
BUG: KASAN: slab-out-of-bounds in tpm2_unseal_trusted
(./include/linux/unaligned.h:48 (discriminator 1)
security/keys/trusted-keys/trusted_tpm2.c:408 (discriminator 1)
security/keys/trusted-keys/trusted_tpm2.c:595 (discriminator 1))
Read of size 2 at addr ffff8880125db7aa by task exploit/149
CPU: 0 UID: 1000 PID: 149 Comm: exploit Tainted: G W 7.2.0+
#31 PREEMPTLAZY
Call Trace:
dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
kasan_report (mm/kasan/report.c:595)
tpm2_unseal_trusted (./include/linux/unaligned.h:48 (discriminator 1)
security/keys/trusted-keys/trusted_tpm2.c:408 (discriminator 1)
security/keys/trusted-keys/trusted_tpm2.c:595 (discriminator 1))
trusted_tpm_unseal (security/keys/trusted-keys/trusted_tpm1.c:928)
trusted_instantiate (security/keys/trusted-keys/trusted_core.c:196)
__key_instantiate_and_link (security/keys/key.c:446)
__key_create_or_update (security/keys/key.c:941)
key_create_or_update (security/keys/key.c:1021)
__do_sys_add_key (security/keys/keyctl.c:134)
do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Allocated by task 149:
kasan_save_stack (mm/kasan/common.c:57)
kasan_save_track (mm/kasan/common.c:78)
__kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)
__kmalloc_noprof (./include/linux/kasan.h:263 mm/slub.c:5337 mm/slub.c:5362)
tpm2_unseal_trusted (./include/linux/slab.h:992
security/keys/trusted-keys/trusted_tpm2.c:119
security/keys/trusted-keys/trusted_tpm2.c:384
security/keys/trusted-keys/trusted_tpm2.c:595)
trusted_tpm_unseal (security/keys/trusted-keys/trusted_tpm1.c:928)
trusted_instantiate (security/keys/trusted-keys/trusted_core.c:196)
__key_instantiate_and_link (security/keys/key.c:446)
__key_create_or_update (security/keys/key.c:941)
key_create_or_update (security/keys/key.c:1021)
__do_sys_add_key (security/keys/keyctl.c:134)
do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
The buggy address belongs to the object at ffff8880125db7a0
which belongs to the cache kmalloc-8 of size 8
The buggy address is located 2 bytes to the right of
allocated 8-byte region [ffff8880125db7a0, ffff8880125db7a8)
The buggy address belongs to the physical page:
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8880125db680: 00 fc fc fc fa fc fc fc 00 fc fc fc fc fc fc fc
ffff8880125db700: fc fc fc fc fc fc fc fc fa fc fc fc 00 fc fc fc
>ffff8880125db780: fc fc fc fc 00 fc fc fc fa fc fc fc fc fc fc fc
^
ffff8880125db800: fc fc fc fc fa fc fc fc 07 fc fc fc fc fc fc fc
ffff8880125db880: fa fc fc fc fc fc fc fc fc fc fc fc 00 fc fc fc
---
The report format is based on syzbot bug report.
This report is generated by a bot. It may contain errors.
See https://github.com/n132/cedalion for more information.
For any issue with this report, reach out to [email protected]
If the report is already addressed, let us know by replying with:
#co fix: <commit hash>
If the report is a duplicate of another one, reply with:
#co dup: <lore link>
If you want to undo deduplication, reply with:
#co undup
