---
id: CVE-2026-98728
title: >-
  kernel: tpm: fix off-by-four bounds check in tpm2_get_random()
  (CVE-2026-98728)
summary: >-
  A flaw was found in the Linux kernel's Trusted Platform Module (TPM) driver.
  This flaw can lead to information disclosure when the kernel requests random
  data. Due to an incorrect bounds check when processing session-tagged
  responses, a tr…
severity: low
cvss: 2.5
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: vendor
cwe: CWE-125
vendor: Red Hat
product: Red Hat Enterprise Linux 10
affected:
  - enterprise_linux 10
  - enterprise_linux 6
published: '2026-10-18'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T00:38:45+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98728.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98728.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98728'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2555107'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98728'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98728'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98728.mbox
  - url: 'https://git.kernel.org/stable/c/be54101992c2c5218be0e0a87827ccc96e3089af'
  - url: 'https://git.kernel.org/stable/c/e30a2406408d2df6d9cd48c2e59e913cf266a05a'
  - url: 'https://git.kernel.org/stable/c/42bb6216b861e892512128219ff23010d656ba14'
  - url: 'https://git.kernel.org/stable/c/9b522400bf5c082feb9a0037a053ea822a2c7e4d'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00168
epssPercentile: 0.05967
ingestedAt: '2026-10-18T16:47:32.507Z'
---

## Overview

A flaw was found in the Linux kernel's Trusted Platform Module (TPM) driver. This flaw can lead to information disclosure when the kernel requests random data. Due to an incorrect bounds check when processing session-tagged responses, a truncated response can pass validation and cause the kernel to read past the end of the buffer. Consequently, stale kernel memory contents may be returned to the caller instead of random data, potentially exposing sensitive information.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98728.json)

**kernel: tpm: fix off-by-four bounds check in tpm2_get_random()** — rated Low by Red Hat. Released 2026-10-18, updated 2026-10-23.

Affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6

No fix planned:

- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 10

Not affected:

- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4

## Remediation

Out of support scope