{"id":"CVE-2026-98728","title":"kernel: tpm: fix off-by-four bounds check in tpm2_get_random() (CVE-2026-98728)","summary":"A flaw was found in the Linux kernel's Trusted Platform Module (TPM) driver. This flaw can lead to information disclosure when the kernel requests random data. Due to an incorrect bounds check when processing session-tagged responses, a tr…","severity":"low","cvss":2.5,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","cvssSource":"vendor","cwe":"CWE-125","vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","affected":["enterprise_linux 10","enterprise_linux 6"],"published":"2026-10-18","updated":"2026-10-23","sourceUpdated":"2026-10-23T00:38:45+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98728.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98728.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-98728"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2555107"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98728"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98728"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98728.mbox"},{"url":"https://git.kernel.org/stable/c/be54101992c2c5218be0e0a87827ccc96e3089af"},{"url":"https://git.kernel.org/stable/c/e30a2406408d2df6d9cd48c2e59e913cf266a05a"},{"url":"https://git.kernel.org/stable/c/42bb6216b861e892512128219ff23010d656ba14"},{"url":"https://git.kernel.org/stable/c/9b522400bf5c082feb9a0037a053ea822a2c7e4d"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00168,"epssPercentile":0.05967,"ingestedAt":"2026-10-18T16:47:32.507Z","slug":"CVE-2026-98728","body":"## Overview\n\nA flaw was found in the Linux kernel's Trusted Platform Module (TPM) driver. This flaw can lead to information disclosure when the kernel requests random data. Due to an incorrect bounds check when processing session-tagged responses, a truncated response can pass validation and cause the kernel to read past the end of the buffer. Consequently, stale kernel memory contents may be returned to the caller instead of random data, potentially exposing sensitive information.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98728.json)\n\n**kernel: tpm: fix off-by-four bounds check in tpm2_get_random()** — rated Low by Red Hat. Released 2026-10-18, updated 2026-10-23.\n\nAffected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 6\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 10\n\nNot affected:\n\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nOut of support scope","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":228232,"id":"CVE-2026-98728","ts":1792758221409,"field":"cvss","old":null,"new":"2.5"},{"seq":228231,"id":"CVE-2026-98728","ts":1792758221409,"field":"severity","old":"none","new":"low"}]}