On Thu, Aug 27, 2026 at 12:42:08PM +0000, co wrote:
> We found a bug reachable in:
>
> path security/keys/trusted-keys
> crash out-of-bounds in tpm2_unseal_trusted()
> commit 2709dd5ae32f ("Merge tag 'sched-urgent-2026-08-22' of
> git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip")
>
> Config, environment, the sanitizer report and a C reproducer follow.
>
> == Notes ===============================================================
> If you patch the bug based on our artifacts, a tag would be
> appreciated:
>
> Reported-by: [email protected]
>
> Everything in this mail is validated by the reproducer below.
>
> We also hold an LLM-generated root-cause analysis and a candidate
> patch. The patch passes an A/B test: the same reproducer panics the
> unpatched kernel and runs clean on the patched one. Neither has had
> human review, so both still require validation before you send or
> apply them. Available on:
>
> patch.diff https://bugs.sh/b/6a581c4284f721d4/patch.diff
> report.md https://bugs.sh/b/6a581c4284f721d4/report.md
>
> This is an open science project. The code and the full set of PoCs
> are not public at this moment, as we intend to disclose our findings
> in an ethical way.
>
> Happy to test patches. Complaints and suggestions about our work
> are welcome at:
>
> [email protected]
>
> == Environment =========================================================
> Reproduced on 2709dd5ae32f ("Merge tag 'sched-urgent-2026-08-22' of
> git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip")
> VM setup https://bugs.sh/b/6a581c4284f721d4/run.sh
> config https://bugs.sh/b/6a581c4284f721d4/config.gz
> poc https://bugs.sh/b/6a581c4284f721d4/repro.c
>
> == Sanitizer Report ====================================================
> BUG: KASAN: slab-out-of-bounds in tpm2_unseal_trusted
> (./include/linux/unaligned.h:48 (discriminator 1)
> security/keys/trusted-keys/trusted_tpm2.c:408 (discriminator 1)
> security/keys/trusted-keys/trusted_tpm2.c:595 (discriminator 1))
> Read of size 2 at addr ffff8880125db7aa by task exploit/149
> CPU: 0 UID: 1000 PID: 149 Comm: exploit Tainted: G W 7.2.0+
> #31 PREEMPTLAZY
> Call Trace:
> dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
> print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
> kasan_report (mm/kasan/report.c:595)
> tpm2_unseal_trusted (./include/linux/unaligned.h:48 (discriminator 1)
> security/keys/trusted-keys/trusted_tpm2.c:408 (discriminator 1)
> security/keys/trusted-keys/trusted_tpm2.c:595 (discriminator 1))
> trusted_tpm_unseal (security/keys/trusted-keys/trusted_tpm1.c:928)
> trusted_instantiate (security/keys/trusted-keys/trusted_core.c:196)
> __key_instantiate_and_link (security/keys/key.c:446)
> __key_create_or_update (security/keys/key.c:941)
> key_create_or_update (security/keys/key.c:1021)
> __do_sys_add_key (security/keys/keyctl.c:134)
> do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
> entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
> Allocated by task 149:
> kasan_save_stack (mm/kasan/common.c:57)
> kasan_save_track (mm/kasan/common.c:78)
> __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)
> __kmalloc_noprof (./include/linux/kasan.h:263 mm/slub.c:5337 mm/slub.c:5362)
> tpm2_unseal_trusted (./include/linux/slab.h:992
> security/keys/trusted-keys/trusted_tpm2.c:119
> security/keys/trusted-keys/trusted_tpm2.c:384
> security/keys/trusted-keys/trusted_tpm2.c:595)
> trusted_tpm_unseal (security/keys/trusted-keys/trusted_tpm1.c:928)
> trusted_instantiate (security/keys/trusted-keys/trusted_core.c:196)
> __key_instantiate_and_link (security/keys/key.c:446)
> __key_create_or_update (security/keys/key.c:941)
> key_create_or_update (security/keys/key.c:1021)
> __do_sys_add_key (security/keys/keyctl.c:134)
> do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)
> entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
> The buggy address belongs to the object at ffff8880125db7a0
> which belongs to the cache kmalloc-8 of size 8
> The buggy address is located 2 bytes to the right of
> allocated 8-byte region [ffff8880125db7a0, ffff8880125db7a8)
> The buggy address belongs to the physical page:
> page dumped because: kasan: bad access detected
> Memory state around the buggy address:
> ffff8880125db680: 00 fc fc fc fa fc fc fc 00 fc fc fc fc fc fc fc
> ffff8880125db700: fc fc fc fc fc fc fc fc fa fc fc fc 00 fc fc fc
> >ffff8880125db780: fc fc fc fc 00 fc fc fc fa fc fc fc fc fc fc fc
> ^
> ffff8880125db800: fc fc fc fc fa fc fc fc 07 fc fc fc fc fc fc fc
> ffff8880125db880: fa fc fc fc fc fc fc fc fc fc fc fc 00 fc fc fc
>
>
> ---
> The report format is based on syzbot bug report.
>
> This report is generated by a bot. It may contain errors.
> See https://github.com/n132/cedalion for more information.
>
> For any issue with this report, reach out to [email protected]
>
> If the report is already addressed, let us know by replying with:
> #co fix: <commit hash>
>
> If the report is a duplicate of another one, reply with:
> #co dup: <lore link>
>
> If you want to undo deduplication, reply with:
> #co undup
>
>
ack as for acknowledging this. i'll look this on monday in detail
(my work week is over and i have weekend activities).
Thank you for reporting!
BR, Jarkko
