CVE-2024-49851 – A vulnerability in the Linux kernel's TPM (Trus... (How to Fix)

Q: What is the severity of CVE-2024-49851?

CVE-2024-49851 has a CVSS score of 5.5 (MEDIUM). A vulnerability in the Linux kernel's TPM (Trusted Platform Module) subsystem allows transient handles to be leaked when TPM command transmission fails. This affects Linux systems using TPM hardware or software emulation. The vulnerability can lead to resource exhaustion and potential denial of service.

📋 TL;DR

A vulnerability in the Linux kernel's TPM (Trusted Platform Module) subsystem allows transient handles to be leaked when TPM command transmission fails. This affects Linux systems using TPM hardware or software emulation. The vulnerability can lead to resource exhaustion and potential denial of service.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not specified in CVE; likely multiple kernel versions before the fix commits

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with TPM hardware or software TPM emulation enabled and in use.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Resource exhaustion leading to kernel panic or system instability, potentially causing denial of service on critical systems.

🟠

Likely Case

Gradual resource leakage over time leading to TPM functionality degradation or failure, requiring system reboot to clear leaked handles.

🟢

If Mitigated

Minimal impact if TPM usage is limited or systems are regularly rebooted; resource leakage would be cleared on reboot.

🌐 Internet-Facing: LOW - This vulnerability requires local access or ability to execute code on the system to trigger TPM commands.

🏢 Internal Only: MEDIUM - Internal attackers with local access could potentially exploit this to degrade system stability or cause denial of service.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires ability to trigger TPM command failures, which typically requires local access or ability to execute code on the system.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 2c9b228938e9266a1065a3f4fe5c99b7235dc439, 3f9f72d843c92fb6f4ff7460d774413cde7f254c, 82478cb8a23bd4f97935bbe60d64528c6d9918b4, 87e8134c18977b566f4ec248c8a147244da69402, adf4ce162561222338cf2c9a2caa294527f7f721

Vendor Advisory: https://git.kernel.org/stable/c/2c9b228938e9266a1065a3f4fe5c99b7235dc439

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Check with your distribution vendor for specific patched kernel versions. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable TPM functionality

linux

Disable TPM hardware or software emulation if not required for system operation

echo 'blacklist tpm' > /etc/modprobe.d/blacklist-tpm.conf
update-initramfs -u
reboot

Regular system reboots

linux

Schedule regular reboots to clear any leaked TPM handles before resource exhaustion occurs

# Add to crontab: 0 0 * * 0 /sbin/reboot

🧯 If You Can't Patch

Monitor TPM resource usage and implement alerting for abnormal handle counts
Implement strict access controls to limit who can execute TPM commands on the system

🔍 How to Verify

Check if Vulnerable:

Check kernel version and compare with distribution's patched versions; examine if TPM module is loaded: lsmod | grep tpm

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits; test TPM functionality after patching

📡 Detection & Monitoring

Log Indicators:

Kernel logs showing TPM errors or failures
System logs indicating TPM resource exhaustion

Network Indicators:

None - this is a local resource management issue

SIEM Query:

source="kernel" AND ("TPM" OR "tpm") AND ("error" OR "fail" OR "leak")

📊 Metadata

CVE ID: CVE-2024-49851

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-459

Published: October 21, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-49851, you might also want to check these: