{"id":"CVE-2026-45871","title":"tpm: st33zp24: Fix missing cleanup on get_burstcount() error","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: st33zp24: Fix missing cleanup on get_burstcount() error\n\nget_burstcount() can return -EBUSY on timeout. When this happens,\nst33zp24_send() returns directly without…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= bf38b8710892333cec2d8069644eb36ff435fd6f < e0ce3da82341fcd6194175f1837946b2a894c625","Linux >= bf38b8710892333cec2d8069644eb36ff435fd6f < 7687133509cf66ced120b667fefd21f80bf17993","Linux >= bf38b8710892333cec2d8069644eb36ff435fd6f < 1256c6dc96d1e687e6e9b63088156ed07411b00c","Linux >= bf38b8710892333cec2d8069644eb36ff435fd6f < a51cff9be046e13e1c1b2fe45d5c48b582ec9b8c","Linux >= bf38b8710892333cec2d8069644eb36ff435fd6f < cc09d55f519e15355de343264a22ac6682b8305e","Linux >= bf38b8710892333cec2d8069644eb36ff435fd6f < ec15eb67fe9df87981b4829b901ec254273ca483","Linux >= bf38b8710892333cec2d8069644eb36ff435fd6f < 4fffb77d35d038f146e6192da583dbe4971d869e","Linux >= bf38b8710892333cec2d8069644eb36ff435fd6f < 3e91b44c93ad2871f89fc2a98c5e4fe6ca5db3d9","Linux 4.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T15:43:01.253995Z"},"published":"2026-05-27","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:53:09.924Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-45871","references":[{"url":"https://git.kernel.org/stable/c/e0ce3da82341fcd6194175f1837946b2a894c625"},{"url":"https://git.kernel.org/stable/c/7687133509cf66ced120b667fefd21f80bf17993"},{"url":"https://git.kernel.org/stable/c/1256c6dc96d1e687e6e9b63088156ed07411b00c"},{"url":"https://git.kernel.org/stable/c/a51cff9be046e13e1c1b2fe45d5c48b582ec9b8c"},{"url":"https://git.kernel.org/stable/c/cc09d55f519e15355de343264a22ac6682b8305e"},{"url":"https://git.kernel.org/stable/c/ec15eb67fe9df87981b4829b901ec254273ca483"},{"url":"https://git.kernel.org/stable/c/4fffb77d35d038f146e6192da583dbe4971d869e"},{"url":"https://git.kernel.org/stable/c/3e91b44c93ad2871f89fc2a98c5e4fe6ca5db3d9"}],"tags":["cve.org"],"epss":0.00186,"epssPercentile":0.08201,"ingestedAt":"2026-11-06T16:57:43.398Z","slug":"CVE-2026-45871","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntpm: st33zp24: Fix missing cleanup on get_burstcount() error\n\nget_burstcount() can return -EBUSY on timeout. When this happens,\nst33zp24_send() returns directly without releasing the locality\nacquired earlier.\n\nUse goto out_err to ensure proper cleanup when get_burstcount() fails.\n\n## Affected\n\n- `Linux >= bf38b8710892333cec2d8069644eb36ff435fd6f < e0ce3da82341fcd6194175f1837946b2a894c625`\n- `Linux >= bf38b8710892333cec2d8069644eb36ff435fd6f < 7687133509cf66ced120b667fefd21f80bf17993`\n- `Linux >= bf38b8710892333cec2d8069644eb36ff435fd6f < 1256c6dc96d1e687e6e9b63088156ed07411b00c`\n- `Linux >= bf38b8710892333cec2d8069644eb36ff435fd6f < a51cff9be046e13e1c1b2fe45d5c48b582ec9b8c`\n- `Linux >= bf38b8710892333cec2d8069644eb36ff435fd6f < cc09d55f519e15355de343264a22ac6682b8305e`\n- `Linux >= bf38b8710892333cec2d8069644eb36ff435fd6f < ec15eb67fe9df87981b4829b901ec254273ca483`\n- `Linux >= bf38b8710892333cec2d8069644eb36ff435fd6f < 4fffb77d35d038f146e6192da583dbe4971d869e`\n- `Linux >= bf38b8710892333cec2d8069644eb36ff435fd6f < 3e91b44c93ad2871f89fc2a98c5e4fe6ca5db3d9`\n- `Linux 4.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}