Description
A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state (for example during a virtual machine's power-on or state/migration restore), a malformed state blob can supply an oversized skip-block length that is not validated against the remaining size of the input buffer. This can drive an internal size counter negative, which bypasses a subsequent bounds check due to an unsafe signed-to-unsigned conversion, causing the parser to read memory outside the bounds of the heap buffer holding the state data. Successful exploitation can crash the process hosting libtpms (such as swtpm), resulting in a denial of service of the emulated TPM device and the virtual machine that depends on it. No data corruption or information disclosure was confirmed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libtpms | No fix yet | — |
| Debian 13 | libtpms | No fix yet | — |
| Debian 12 | libtpms | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libtpms | No fix yet | — |
| Ubuntu 26.04 LTS | libtpms | No fix yet | — |
| Ubuntu 24.04 LTS | libtpms | No fix yet | — |
| Ubuntu 22.04 LTS | libtpms | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | libtpms | 0.9.6-150600.3.6.1 | SUSE-SU-2026:4363-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.1 | libtpms | 0.9.6-slfo.1.1_3.1 | SUSE-SU-2026:23926-1 |
| SLE Micro 6.0 | libtpms | 0.9.6-3.1 | SUSE-SU-2026:23878-1 |
| SLE Micro 5.5 | libtpms | 0.8.2-150300.3.12.1 | SUSE-SU-2026:4278-1 |
| SLE Micro 5.4 | libtpms | 0.8.2-150300.3.12.1 | SUSE-SU-2026:4278-1 |
| SLE Micro 5.3 | libtpms | 0.8.2-150300.3.12.1 | SUSE-SU-2026:4278-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libtpms | 0.10.2-2.1 | openSUSE-SU-2026:11836-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libtpms | 0.9.6-9 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
isukasanuj/CVE-2026-85769 ★ 0 · Sep 4, 2026
Heap out-of-bounds read in libtpms TPM 2.0 state deserialization — CVE-2026-85769
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 6
- SUSE-SU-2026:23926-1 Security update for libtpms SUSE / openSUSE Security Updates · Sep 30, 2026
- WID-SEC-2026-3216 libtpms: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Sep 29, 2026
- SUSE-SU-2026:4363-1 Security update for libtpms SUSE / openSUSE Security Updates · Sep 29, 2026
- SUSE-SU-2026:23878-1 Security update for libtpms SUSE / openSUSE Security Updates · Sep 28, 2026
- SUSE-SU-2026:4278-1 Security update for libtpms SUSE / openSUSE Security Updates · Sep 23, 2026
- openSUSE-SU-2026:11836-1 libtpms-devel-0.10.2-2.1 on GA media SUSE / openSUSE Security Updates · Sep 22, 2026