---
id: CVE-2026-99221
title: 'keys/trusted_keys: return immediately after TPM unseal failure'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  keys/trusted_keys: return immediately after TPM unseal failure

  trusted_tpm_unseal() proceeds to pcrlock() when the TPM unseal operation
  fails. If pcrlock() succeeds, i…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5d0682be318910e028bdf57c90a1695ffc34be37 <
    4876f09ce222e140a73aad950882b3605440c935
  - >-
    Linux >= 5d0682be318910e028bdf57c90a1695ffc34be37 <
    2d92a0f87c338a08367aff05edd1ade86da4ac8d
  - >-
    Linux >= 5d0682be318910e028bdf57c90a1695ffc34be37 <
    234d09bb3b3d84851d4b3246272addc30f3353eb
  - >-
    Linux >= 5d0682be318910e028bdf57c90a1695ffc34be37 <
    6e359d8cb8580b9874801dea930086effd4d9c62
  - >-
    Linux >= 5d0682be318910e028bdf57c90a1695ffc34be37 <
    e55d48f21f591a9fe80d26b5fbd1912ea725d9e6
  - >-
    Linux >= 5d0682be318910e028bdf57c90a1695ffc34be37 <
    63b19ec2863b2cb5279b746ecd3d6210b1a93945
  - >-
    Linux >= 5d0682be318910e028bdf57c90a1695ffc34be37 <
    ed697a5f667435bbb1cedbe5bd9f300de645047d
  - >-
    Linux >= 5d0682be318910e028bdf57c90a1695ffc34be37 <
    f92d0ccb05bf9089072cb067dda0dffd5394c4ef
  - Linux 5.13
published: '2026-11-02'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T19:12:55.574Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99221'
references:
  - url: 'https://git.kernel.org/stable/c/4876f09ce222e140a73aad950882b3605440c935'
  - url: 'https://git.kernel.org/stable/c/2d92a0f87c338a08367aff05edd1ade86da4ac8d'
  - url: 'https://git.kernel.org/stable/c/234d09bb3b3d84851d4b3246272addc30f3353eb'
  - url: 'https://git.kernel.org/stable/c/6e359d8cb8580b9874801dea930086effd4d9c62'
  - url: 'https://git.kernel.org/stable/c/e55d48f21f591a9fe80d26b5fbd1912ea725d9e6'
  - url: 'https://git.kernel.org/stable/c/63b19ec2863b2cb5279b746ecd3d6210b1a93945'
  - url: 'https://git.kernel.org/stable/c/ed697a5f667435bbb1cedbe5bd9f300de645047d'
  - url: 'https://git.kernel.org/stable/c/f92d0ccb05bf9089072cb067dda0dffd5394c4ef'
tags:
  - cve.org
epss: 0.00177
epssPercentile: 0.07304
ingestedAt: '2026-11-05T20:33:06.387Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

keys/trusted_keys: return immediately after TPM unseal failure

trusted_tpm_unseal() proceeds to pcrlock() when the TPM unseal operation
fails. If pcrlock() succeeds, its return value overwrites the unseal error,
causing key instantiation to succeed.

Return immediately when unseal fails to preserve the original error.

## Affected

- `Linux >= 5d0682be318910e028bdf57c90a1695ffc34be37 < 4876f09ce222e140a73aad950882b3605440c935`
- `Linux >= 5d0682be318910e028bdf57c90a1695ffc34be37 < 2d92a0f87c338a08367aff05edd1ade86da4ac8d`
- `Linux >= 5d0682be318910e028bdf57c90a1695ffc34be37 < 234d09bb3b3d84851d4b3246272addc30f3353eb`
- `Linux >= 5d0682be318910e028bdf57c90a1695ffc34be37 < 6e359d8cb8580b9874801dea930086effd4d9c62`
- `Linux >= 5d0682be318910e028bdf57c90a1695ffc34be37 < e55d48f21f591a9fe80d26b5fbd1912ea725d9e6`
- `Linux >= 5d0682be318910e028bdf57c90a1695ffc34be37 < 63b19ec2863b2cb5279b746ecd3d6210b1a93945`
- `Linux >= 5d0682be318910e028bdf57c90a1695ffc34be37 < ed697a5f667435bbb1cedbe5bd9f300de645047d`
- `Linux >= 5d0682be318910e028bdf57c90a1695ffc34be37 < f92d0ccb05bf9089072cb067dda0dffd5394c4ef`
- `Linux 5.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.