{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "1b6d7f9eb150305dcb0da4f7101a8d30dcdf0497"
            },
            {
              "fixed": "be54101992c2c5218be0e0a87827ccc96e3089af"
            },
            {
              "fixed": "e30a2406408d2df6d9cd48c2e59e913cf266a05a"
            },
            {
              "fixed": "42bb6216b861e892512128219ff23010d656ba14"
            },
            {
              "fixed": "9b522400bf5c082feb9a0037a053ea822a2c7e4d"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.10.0"
            },
            {
              "fixed": "6.12.113"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.56"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98728.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: fix off-by-four bounds check in tpm2_get_random()\n\nWhen the response carries the TPM2_ST_SESSIONS tag, tpm2_get_random()\nskips the 4-byte parameter size field before locating the random data,\nbut the bounds check still validates the response length against\nTPM_HEADER_SIZE.  A truncated response can pass the check and make\nmemcpy() read up to 4 bytes past the response end, so stale buffer\ncontents end up in the caller's random bytes.\n\nFix this by checking the response length against 'offset', which\nalready includes the skipped parameter size field.",
  "id": "CVE-2026-98728",
  "modified": "2026-10-19T02:30:46.213327523Z",
  "published": "2026-10-18T15:47:05.722Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/42bb6216b861e892512128219ff23010d656ba14"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9b522400bf5c082feb9a0037a053ea822a2c7e4d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/be54101992c2c5218be0e0a87827ccc96e3089af"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e30a2406408d2df6d9cd48c2e59e913cf266a05a"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98728.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98728"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "tpm: fix off-by-four bounds check in tpm2_get_random()"
}