tpm2-pkcs11 version 1.9.0 should be skipped

William Roberts <[email protected]> Fri, 1 May 2026 12:17:22 -0500
Newsgroups dev.linux.lists.tpm2
Message-ID <CAFftDdp6tHBFHxe+S_Du11hqubfhNoap-wOfhDKqQAauy=k=dQ@mail.gmail.com>
Hello,

TL;DR Skip 1.9.0 when possible.

A bug captured here:
  - https://github.com/tpm2-software/tpm2-pkcs11/issues/805

Highlights an important bug that could hinder database upgrades. The
major takeaway is that a bug in the C code path for updating the DB
Schema from version 7 to 8, had a null pointer bug. This was fixed in
1.9.1, but as distros are updating their library versions, this bug is
becoming more prevalent.  I would urge folks to skip 1.9.0 and upgrade
to 1.9.1 if possible. Also, the tpm2_ptool path doesn't have this
problem, but another problem was discovered in tpm2_ptool where it
couldn't handle the older hex encoded list of CKA_ALLOWED_MECHANISMS
when performing the db update. At some point, the hex encoded buffer
went away and proper sequence (list) of YAML integers was used.
However, the DB Code on the C path wouldn't actually apply the change,
this was fixed in release
https://github.com/tpm2-software/tpm2-pkcs11/releases/tag/1.10.0-rc0

Thanks,
Bill