CVE-2026-6727

Name	CVE-2026-6727
Description	A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys, including the RSA Endorsement Key (EK), including import blobs, credential blobs, and session salts. Under certain conditions, this may also enable the forgery of TPM 2.0 attestations. Refer to TCGVRT0011.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libtpms (PTS)	bookworm	0.9.2-3.1+deb12u1	vulnerable
	bookworm (security)	0.9.2-3.1~deb12u1	vulnerable
	trixie	0.9.2-3.2	vulnerable
	forky, sid	0.10.2-5	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libtpms	source	(unstable)	(unfixed)	unimportant

Notes

Fixed by: https://github.com/stefanberger/libtpms/commit/fd5b4174622032e131b70389b40ec6add4da3237 (stable-0.10 branch)
Fixed by: https://github.com/stefanberger/libtpms/commit/b26c0755e3ae37c41da9822027098878bdb5a196 (stable-0.9 branch)
Debian binary packages not build with --disable-use-openssl-functions or -DUSE_OPENSSL_FUNCTIONS_RSA=0
https://groups.google.com/g/libtpms-announce/c/xB2PqSQRA_8