CVE-2026-72135

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

tpm: Make the TPM character devices non-seekable

The TPM character devices expose a sequential command/response

interface, but their open handlers leave FMODE_PREAD and FMODE_PWRITE

enabled.

After a command leaves a response pending, pread(fd, buf, 16, 0x1400)

passes 0x1400 as *off to tpm_common_read(). The transfer length is

bounded by response_length, but the offset is used unchecked when

forming data_buffer + *off. A sufficiently large offset therefore causes

an out-of-bounds heap read through copy_to_user() and, if the copy

succeeds, an out-of-bounds zero-write through the following memset().

Positional I/O does not provide coherent semantics for this interface.

An arbitrary pread offset cannot represent how much of a response has

been consumed sequentially. The write callback always stores a command

at the start of data_buffer, while pwrite() does not update file->f_pos

and can leave the sequential read cursor

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References