libtpms and CVE-2026-6726 and CVE-2026-6727

[Stefan Berger]

Hello!

Two vulnerabilities for TPM 2 were filed today:

- CVE-2026-6726 : not vulnerable due to previous fix

- CVE-2026-6727 : unlikely to be vulnerable unless OpenSSL crypto
functions are intentionally avoided (see below)

You can read about them here: https://kb.cert.org/vuls/id/431093

I have applied patches to all branches, stable-0.8 and more recent, but
I do not think that libtpms is vulnerable for any normal build. I also
did not create any new libtpms versions in branches.

More details about the CVEs:

CVE-2026-6726:
==============

From my commit message:

libtpms does NOT seem to be affected by the vulnerability since a
previous commit already resolved this issue (resolved a libtpms-specific
CVE) and the non-public test case does not show a vulnerability:

-
https://github.com/stefanberger/libtpms/commit/33a03986e0a09dde439985e0312d1c8fb3743aab
-
https://github.com/stefanberger/libtpms/commit/17255da54cf8354d02369f1323dc50cfb87e2bf

This patch has been applied to v0.8.5, v0.9.0, v0.10.0 and more recent
versions.


CVE-2026-6727:
==============

From my commit message:

Libtpms is typically not affected unless it was configured with
'--disable-use-openssl-functions' or if it was built with
'-DUSE_OPENSSL_FUNCTIONS_RSA=0'. Neither would be the 'typical' case and
is unlikely that it was built like this by a distro.

If the non-public test case is run against a 'typical' libtpms build
that relies on OpenSSL functions for RSA encryption, then no
vulnerability is detected. Otherwise it does detect a vulnerability.


Regards,
Stefan