{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-99221",
  "modified": "2026-11-03T05:30:01Z",
  "upstream": [
    "CVE-2026-99221"
  ],
  "published": "2026-11-02T15:14:24Z",
  "summary": "keys/trusted_keys: return immediately after TPM unseal failure",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nkeys/trusted_keys: return immediately after TPM unseal failure\n\ntrusted_tpm_unseal() proceeds to pcrlock() when the TPM unseal operation\nfails. If pcrlock() succeeds, its return value overwrites the unseal error,\ncausing key instantiation to succeed.\n\nReturn immediately when unseal fails to preserve the original error.",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.191",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-99221"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/4876f09ce222e140a73aad950882b3605440c935"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/2d92a0f87c338a08367aff05edd1ade86da4ac8d"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/234d09bb3b3d84851d4b3246272addc30f3353eb"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/6e359d8cb8580b9874801dea930086effd4d9c62"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/e55d48f21f591a9fe80d26b5fbd1912ea725d9e6"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/63b19ec2863b2cb5279b746ecd3d6210b1a93945"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ed697a5f667435bbb1cedbe5bd9f300de645047d"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-11-02T15:14:24Z"
  }
}