Description
A flaw was found in the libtpms code that may cause access beyond the boundary of internal buffers. The vulnerability is triggered by specially-crafted TPM2 command packets that then trigger the issue when the state of the TPM2's volatile state is written. The highest threat from this vulnerability is to system availability. This issue affects libtpms versions before 0.8.5, before 0.7.9 and before 0.6.6.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | libtpms | libtpms 0.8.5, libtpms 0.7.9, libtpms 0.6.6 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libtpms | 0.9.1-1 | — |
| Debian 13 | libtpms | 0.9.1-1 | — |
| Debian 12 | libtpms | 0.9.1-1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | libtpms | 0.8.2-3.3.1 | SUSE-SU-2021:3004-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 5.1 | libtpms | 0.8.2-3.3.1 | SUSE-SU-2021:3004-2 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.3 | libtpms | 0.8.2-3.3.1 | openSUSE-SU-2021:3004-1 |
Advisories 3
- SUSE-SU-2021:3004-2 Security update for libtpms SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:3004-1 Security update for libtpms SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:3004-1 Security update for libtpms SUSE / openSUSE Security Updates · Feb 4, 2026