CVE-2025-71077 tpm: Cap the number of PCR banks
An attacker can cause limited harm via out-of-bounds values in TPM PCR bank allocation due to missing upper limit checks in the Linux kernel.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-71077?
CVE-2025-71077 is a medium-severity vulnerability in Linux kernel, published on 13 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tpm: Cap the number of PCR banks
tpm2_get_pcr_allocation() does not cap any upper limit for the number of banks. Cap the limit to eight banks so that out of bounds values coming from external I/O cause on only limited harm.
Weakness: CWE-20
Which versions are affected by CVE-2025-71077?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-71077?
Apply the vendor's patch.
Is CVE-2025-71077 being exploited?
There is no known exploitation of CVE-2025-71077 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-74439, BELL-CVE-2025-71077, DEBIAN-CVE-2025-71077, GHSA-cx57-3hc8-q627, ROOT-OS-DEBIAN-11-CVE-2025-71077, ROOT-OS-DEBIAN-12-CVE-2025-71077 and 4 more.