Bug 2565256 (CVE-2026-99221)

Summary:	CVE-2026-99221 kernel: kernel: invalid trusted key instantiation via unhandled TPM unseal failure
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability-draft	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's trusted keys subsystem. During the process of unsealing a key using a Trusted Platform Module (TPM), the kernel fails to abort if the unseal operation fails, allowing a subsequent locking operation to overwrite the failure status with a success code. A local user could exploit this flaw to instantiate trusted keys despite unsealing failures, potentially bypassing security controls.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-02 16:29:46 UTC

In the Linux kernel, the following vulnerability has been resolved:

keys/trusted_keys: return immediately after TPM unseal failure

trusted_tpm_unseal() proceeds to pcrlock() when the TPM unseal operation
fails. If pcrlock() succeeds, its return value overwrites the unseal error,
causing key instantiation to succeed.

Return immediately when unseal fails to preserve the original error.