PT-2026-2524 · Linux+2 · Linux Kernel+2

Published 2025-11-30 · Updated 2026-05-07 · CVE-2025-68792

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:L/AC:H/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw in the tpm2-sessions component where the name size variable lacks range checks. This could allow for out-of-range indexing, potentially leading to memory corruption. The issue is addressed by restricting processing to known values and returning an error for unrecognized values. The functions tpm buf append name and tpm buf fill hmac session are modified to detect errors before generating incorrect TPM traffic, and authorization sessions are terminated upon failure to prevent state corruption.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Validation of Array Index

Weakness Enumeration

CWE-129

CWE-823

Related Identifiers

BDU:2026-01049

CVE-2025-68792

OPENSUSE-SU-2026:20287-1

SUSE-SU-2026:20555-1

SUSE-SU-2026:20599-1

SUSE-SU-2026:20615-1

USN-8177-1

USN-8177-2

USN-8183-1

USN-8183-2

USN-8245-1

USN-8257-1

Affected Products

Linuxmint

Linux Kernel

Ubuntu

References · 618

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68792.json · Exploit
• https://ubuntu.com/security/CVE-2025-71073 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-71098 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8183-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68805 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-71080 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68822 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68803 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-71084 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8177-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-71078 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-71097 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-71122 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-71079 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68795 · Vendor Advisory