CVE-2026-72152 - Vulnerability Details

- tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()

Description

In the Linux kernel, the following vulnerability has been resolved:

tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()

wait_event_interruptible_timeout() evaluates its condition after setting
the current task state to TASK_INTERRUPTIBLE.

With CONFIG_DEBUG_ATOMIC_SLEEP this triggers a warning when the IRQ wait
path is used:

tpm_tis_status()
tpm_tis_spi_read_bytes()
tpm_tis_spi_transfer_full()
spi_bus_lock()
mutex_lock()

Address this with the following measures:

1. Call wait_tpm_stat_cond() only while tasking is running.
2. Use wait_woken() to wait for changes.

Published: 2026-08-15

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1a339b658d9dbe1471f67b78237cf8fa08bbbeb5`	affected	< c9acbe38797bc1aa3c22a1ab72452e210af6e0ff
`1a339b658d9dbe1471f67b78237cf8fa08bbbeb5`	affected	< 6b068a97958aa00a901a9b5083d74114b21f7b66
`1a339b658d9dbe1471f67b78237cf8fa08bbbeb5`	affected	< bb63a0530e8e6de3aaf29cd5ba487db2490128ef
`1a339b658d9dbe1471f67b78237cf8fa08bbbeb5`	affected	< ba33b4f9d3423accd2c91a0b0b0680cd589922f2
`1a339b658d9dbe1471f67b78237cf8fa08bbbeb5`	affected	< 4bb3e1bc142dc9c3240ceed1b3ab031aa9cb1723
`1a339b658d9dbe1471f67b78237cf8fa08bbbeb5`	affected	< c0c9cfb3b75def8bf200a2d4db09015806acfeaf
`cd4ae0b05126cc9461a2e50ccb745e5583cc91e2`	affected	—
`cf503dbe5c22c6ab9797e1cf864a11597d711c3a`	affected	—
`d229e7ecc0cb29996688f0fa98c5eb6128b81e3a`	affected	—
`4.9.128`	affected	< 4.10
`4.14.71`	affected	< 4.15
`4.18.9`	affected	< 4.19

Linux

affected

Version	Status	Constraints
`4.19`	affected	—
`0`	unaffected	< 4.19
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1a339b658d9dbe1471f67b78237cf8fa08bbbeb5,c9acbe38797bc1aa3c22a1ab72452e210af6e0ff)`	affected	code_commit	—
`[1a339b658d9dbe1471f67b78237cf8fa08bbbeb5,6b068a97958aa00a901a9b5083d74114b21f7b66)`	affected	code_commit	—
`[1a339b658d9dbe1471f67b78237cf8fa08bbbeb5,bb63a0530e8e6de3aaf29cd5ba487db2490128ef)`	affected	code_commit	—
`[1a339b658d9dbe1471f67b78237cf8fa08bbbeb5,ba33b4f9d3423accd2c91a0b0b0680cd589922f2)`	affected	code_commit	—
`[1a339b658d9dbe1471f67b78237cf8fa08bbbeb5,4bb3e1bc142dc9c3240ceed1b3ab031aa9cb1723)`	affected	code_commit	—
`[1a339b658d9dbe1471f67b78237cf8fa08bbbeb5,c0c9cfb3b75def8bf200a2d4db09015806acfeaf)`	affected	code_commit	—
`cd4ae0b05126cc9461a2e50ccb745e5583cc91e2`	affected	code_commit	—
`cf503dbe5c22c6ab9797e1cf864a11597d711c3a`	affected	code_commit	—
`d229e7ecc0cb29996688f0fa98c5eb6128b81e3a`	affected	code_commit	—
`[4.9.128,4.10)`	affected	semver	—
`[4.14.71,4.15)`	affected	semver	—
`[4.18.9,4.19)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.19`	affected	semver	—
`[0,4.19)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00215.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/4bb3e1bc142dc9c3240ceed1b3ab031aa9cb1723
https://git.kernel.org/stable/c/6b068a97958aa00a901a9b5083d74114b21f7b66
https://git.kernel.org/stable/c/ba33b4f9d3423accd2c91a0b0b0680cd589922f2
https://git.kernel.org/stable/c/bb63a0530e8e6de3aaf29cd5ba487db2490128ef
https://git.kernel.org/stable/c/c0c9cfb3b75def8bf200a2d4db09015806acfeaf
https://git.kernel.org/stable/c/c9acbe38797bc1aa3c22a1ab72452e210af6e0ff

History

Sat, 15 Aug 2026 09:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-703

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat() wait_event_interruptible_timeout() evaluates its condition after setting the current task state to TASK_INTERRUPTIBLE. With CONFIG_DEBUG_ATOMIC_SLEEP this triggers a warning when the IRQ wait path is used: tpm_tis_status() tpm_tis_spi_read_bytes() tpm_tis_spi_transfer_full() spi_bus_lock() mutex_lock() Address this with the following measures: 1. Call wait_tpm_stat_cond() only while tasking is running. 2. Use wait_woken() to wait for changes.
Title		tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/4bb3e1bc142dc9c3240ceed1b3ab031aa9cb1723 https://git.kernel.org/stable/c/6b068a97958aa00a901a9b5083d74114b21f7b66 https://git.kernel.org/stable/c/ba33b4f9d3423accd2c91a0b0b0680cd589922f2 https://git.kernel.org/stable/c/bb63a0530e8e6de3aaf29cd5ba487db2490128ef https://git.kernel.org/stable/c/c0c9cfb3b75def8bf200a2d4db09015806acfeaf https://git.kernel.org/stable/c/c9acbe38797bc1aa3c22a1ab72452e210af6e0ff

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:53:22.951Z

Updated: 2026-08-15T05:53:22.951Z

Reserved: 2026-08-09T03:40:39.909Z

Link: CVE-2026-72152

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:21:32.923

Modified: 2026-08-15T06:21:32.923

Link: CVE-2026-72152

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-15T20:45:03Z

Weaknesses

CWE-703
Improper Check or Handling of Exceptional Conditions

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object