{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2022-49287", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2022-49287", "idYear": 2022, "status": "PUBLISHED", "publishedAt": "2025-02-26T01:56:26.059Z", "updatedAt": "2026-08-05T08:54:36.034Z", "importedAt": "2026-10-24T01:56:49.724Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "tpm: fix reference counting for struct tpm_chip", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\ntpm: fix reference counting for struct tpm_chip\n\nThe following sequence of operations results in a refcount warning:\n\n1. Open device /dev/tpmrm.\n2. Remove module tpm_tis_spi.\n3. Write a TPM command to the file descriptor opened at step 1.\n\n------------[ cut here ]------------\nWARNING: CPU: 3 PID: 1161 at lib/refcount.c:25 kobject_get+0xa0/0xa4\nrefcount_t: addition on 0; use-after-free.\nModules linked in: tpm_tis_spi tpm_tis_core tpm mdio_bcm_unimac brcmfmac\nsha256_generic libsha256 sha256_arm hci_uart btbcm bluetooth cfg80211 vc4\nbrcmutil ecdh_generic ecc snd_soc_core crc32_arm_ce libaes\nraspberrypi_hwmon ac97_bus snd_pcm_dmaengine bcm2711_thermal snd_pcm\nsnd_timer genet snd phy_generic soundcore [last unloaded: spi_bcm2835]\nCPU: 3 PID: 1161 Comm: hold_open Not tainted 5.10.0ls-main-dirty #2\nHardware name: BCM2711\n[] (unwind_backtrace) from [] (show_stack+0x10/0x14)\n[] (show_stack) from [] (dump_stack+0xc4/0xd8)\n[] (dump_stack) from [] (__warn+0x104/0x108)\n[] (__warn) from [] (warn_slowpath_fmt+0x74/0xb8)\n[] (warn_slowpath_fmt) from [] (kobject_get+0xa0/0xa4)\n[] (kobject_get) from [] (tpm_try_get_ops+0x14/0x54 [tpm])\n[] (tpm_try_get_ops [tpm]) from [] (tpm_common_write+0x38/0x60 [tpm])\n[] (tpm_common_write [tpm]) from [] (vfs_write+0xc4/0x3c0)\n[] (vfs_write) from [] (ksys_write+0x58/0xcc)\n[] (ksys_write) from [] (ret_fast_syscall+0x0/0x4c)\nException stack(0xc226bfa8 to 0xc226bff0)\nbfa0: 00000000 000105b4 00000003 beafe664 00000014 00000000\nbfc0: 00000000 000105b4 000103f8 00000004 00000000 00000000 b6f9c000 beafe684\nbfe0: 0000006c beafe648 0001056c b6eb6944\n---[ end trace d4b8409def9b8b1f ]---\n\nThe reason for this warning is the attempt to get the chip->dev reference\nin tpm_common_write() although the reference counter is already zero.\n\nSince commit 8979b02aaf1d (\"tpm: Fix reference count to main device\") the\nextra reference used to prevent a premature zero counter is never taken,\nbecause the required TPM_CHIP_FLAG_TPM2 flag is never set.\n\nFix this by moving the TPM 2 character device handling from\ntpm_chip_alloc() to tpm_add_char_device() which is called at a later point\nin time when the flag has been set in case of TPM2.\n\nCommit fdc915f7f719 (\"tpm: expose spaces via a device link /dev/tpmrm\")\nalready introduced function tpm_devs_release() to release the extra\nreference but did not implement the required put on chip->devs that results\nin the call of this function.\n\nFix this by putting chip->devs in tpm_chip_unregister().\n\nFinally move the new implementation for the TPM 2 handling into a new\nfunction to avoid multiple checks for the TPM_CHIP_FLAG_TPM2 flag in the\ngood case and error cases.", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66", "status": "affected", "versionType": "git", "lessThan": "473a66f99cb8173c14138c5a5c69bfad04e8f9ac" }, { "version": "fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66", "status": "affected", "versionType": "git", "lessThan": "cb64bd038beacb4331fe464a36c8b5481e8f51e2" }, { "version": "fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66", "status": "affected", "versionType": "git", "lessThan": "a27ed2f3695baf15f9b34d2d7a1f9fc105539a81" }, { "version": "fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66", "status": "affected", "versionType": "git", "lessThan": "290e05f346d1829e849662c97e42d5ad984f5258" }, { "version": "fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66", "status": "affected", "versionType": "git", "lessThan": "662893b4f6bd466ff9e1cd454c44c26d32d554fe" }, { "version": "fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66", "status": "affected", "versionType": "git", "lessThan": "2f928c0d5c02dbab49e8c19d98725c822f6fc409" }, { "version": "fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66", "status": "affected", "versionType": "git", "lessThan": "6e7baf84149fb43950631415de231b3a41915aa3" }, { "version": "fdc915f7f71939ad5a3dda3389b8d2d7a7c5ee66", "status": "affected", "versionType": "git", "lessThan": "7e0438f83dc769465ee663bb5dcf8cc154940712" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "4.12", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "4.12" }, { "version": "4.14.276", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "4.14.*" }, { "version": "4.19.238", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "4.19.*" }, { "version": "5.4.189", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.4.*" }, { "version": "5.10.110", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.10.*" }, { "version": "5.15.33", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.15.*" }, { "version": "5.16.19", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.16.*" }, { "version": "5.17.1", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.17.*" }, { "version": "5.18", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }