Log in Start free

Vulnerability · Published Sep 17, 2026 · Assigned by Linux

CVE-2026-90070tpm: st33zp24: Return zero on status read failure

Unrated

In plain English

A security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS )–Not rated
Exploit odds (30 days)0.2%top 87.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: tpm: st33zp24: Return zero on status read failure st33zp24_status() ignores the result of the transport read and returns data even when no byte was received. The I2C transport, for example, skips i2c_master_recv() when the register-select write is short or fails, leaving data uninitialized. The resulting stack value can be interpreted as TPM_STS flags and let status checks complete spuriously. The status callback cannot propagate a transport error. Return zero unless recv() reports exactly one byte. With no status bits set, callers retry or take their existing timeout or error path instead of acting on an invalid status value. This issue was found by a static analysis checker and confirmed by manual source review.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.190-1DEBIAN-CVE-2026-90070
Debian:13linux6.12.111-1DEBIAN-CVE-2026-90070
Debian:14linux7.2.6-1DEBIAN-CVE-2026-90070
Debian:12linux-6.126.12.111-1~deb12u1DEBIAN-CVE-2026-90070
Ubuntu:22.04:LTSlinux5.15.0-202.212UBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinuxno fix listedUBUNTU-CVE-2026-90070
Ubuntu:26.04:LTSlinux7.0.0-42.42UBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-aws5.15.0-1119.126UBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-awsno fix listedUBUNTU-CVE-2026-90070
Ubuntu:26.04:LTSlinux-aws7.0.0-1016.17UBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-aws-6.14no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-aws-6.17no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-aws-6.8no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-aws-7.0no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-azure5.15.0-1125.134UBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-azureno fix listedUBUNTU-CVE-2026-90070
Ubuntu:26.04:LTSlinux-azureno fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-azure-6.14no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-azure-6.17no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-azure-6.8no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-azure-7.0no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1124.133UBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-azure-fdeno fix listedUBUNTU-CVE-2026-90070
Ubuntu:26.04:LTSlinux-azure-fdeno fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-azure-fde-6.14no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-azure-fde-6.17no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-azure-fde-6.8no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-azure-fde-7.0no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-azure-nvidiano fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-azure-nvidia-6.14no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-gcp5.15.0-1120.130UBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-gcpno fix listedUBUNTU-CVE-2026-90070
Ubuntu:26.04:LTSlinux-gcp7.0.0-1016.18UBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-gcp-6.14no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-gcp-6.17no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-gcp-6.8no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-gcp-7.0no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-gke5.15.0-1115.121UBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-gkeno fix listedUBUNTU-CVE-2026-90070
Ubuntu:26.04:LTSlinux-gkeno fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1102.110UBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-gkeopno fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-hwe-6.14no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-hwe-6.17no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-hwe-6.8no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-hwe-7.07.0.0-42.42~24.04.1UBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-ibm5.15.0-1113.117UBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-ibmno fix listedUBUNTU-CVE-2026-90070
Ubuntu:26.04:LTSlinux-ibm7.0.0-1017.17UBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-ibm-6.8no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1114.120UBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-kvm5.15.0-1111.116UBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-197.207UBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-lowlatencyno fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.8no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1114.115UBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-nvidiano fix listedUBUNTU-CVE-2026-90070
Ubuntu:26.04:LTSlinux-nvidiano fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-nvidia-6.17no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-nvidia-6.8no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-nvidia-7.0no fix listedUBUNTU-CVE-2026-90070
Ubuntu:26.04:LTSlinux-nvidia-bosno fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-nvidia-lowlatencyno fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1070.72UBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-nvidia-tegrano fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1059.59UBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-oem-6.14no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-oem-6.17no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2026-90070
Ubuntu:26.04:LTSlinux-oem-7.07.0.0-1017.17UBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-oracle5.15.0-1116.122UBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-oracleno fix listedUBUNTU-CVE-2026-90070
Ubuntu:26.04:LTSlinux-oracle7.0.0-1015.16UBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-oracle-6.14no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-oracle-6.17no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-oracle-6.8no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-oracle-7.0no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-raspino fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-raspino fix listedUBUNTU-CVE-2026-90070
Ubuntu:26.04:LTSlinux-raspino fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-90070
Ubuntu:26.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-90070
Ubuntu:26.04:LTSlinux-riscv7.0.0-42.42.1UBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-riscv-6.17no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-riscv-6.8no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-riscv-7.07.0.0-42.42.1~24.04.1UBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-vmwareno fix listedUBUNTU-CVE-2026-90070
Ubuntu:24.04:LTSlinux-xilinxno fix listedUBUNTU-CVE-2026-90070
Ubuntu:22.04:LTSlinux-xilinx-zynqmpno fix listedUBUNTU-CVE-2026-90070

Affected products (as reported)

VendorProductVersions
Linux Linux 251a7b08213af82e40e4a70cac056e245853c410 – before d732cfc4befe28f02ec82ed5fd2bc2a21fbabd42251a7b08213af82e40e4a70cac056e245853c410 – before 4973e8386257eed10e5433a94a53bcc6ec37d2a1251a7b08213af82e40e4a70cac056e245853c410 – before 981307e2e8a930da492c2bcf763865c47c2a5165251a7b08213af82e40e4a70cac056e245853c410 – before 1bfd5c54e40704ce93d128a25de3d8dd772bf183251a7b08213af82e40e4a70cac056e245853c410 – before 38c26fe4522963a91d4fb02c844d8faa740fe9d1251a7b08213af82e40e4a70cac056e245853c410 – before 14feaa498c20c1b7ddefe27de5329aaff822cc0d251a7b08213af82e40e4a70cac056e245853c410 – before e6d7d9b665419cda3e9f91030d81c9f8ba71e51d251a7b08213af82e40e4a70cac056e245853c410 – before 8b92687708f5ef980de01c2042dbd76d11f78547
Linux Linux 3.9

References