{"apiVersion":"1.0","identifier":"CVE-2026-72135","description":"In the Linux kernel, the following vulnerability has been resolved: tpm: Make the TPM character devices non-seekable The TPM character devices expose a sequential command/response interface, but their open handlers leave FMODE_PREAD and FMODE_PWRITE enabled. After a command leaves a response pending, pread(fd, buf, 16, 0x1400) passes 0x1400 as *off to tpm_common_read(). The transfer length is bounded by response_length, but the offset is used unchecked when forming data_buffer + *off. A sufficiently large offset therefore causes an out-of-bounds heap read through copy_to_user() and, if the copy succeeds, an out-of-bounds zero-write through the following memset(). Positional I/O does not provide coherent semantics for this interface. An arbitrary pread offset cannot represent how much of a response has been consumed sequentially. The write callback always stores a command at the start of data_buffer, while pwrite() does not update file->f_pos and can leave the sequential read cursor stale. Call nonseekable_open() from both open handlers. This removes FMODE_PREAD and FMODE_PWRITE, causing positional reads and writes to fail with -ESPIPE before reaching the TPM callbacks, and explicitly marks the files non-seekable. Normal read() and write() continue to use the existing sequential f_pos cursor, leaving the response state machine unchanged. Tested on Linux 6.12 with KASAN and a swtpm TPM2 device: - sequential partial reads returned the complete response - pread() and preadv() with offset 0x1400 returned -ESPIPE - pwrite() and pwritev() with offset zero returned -ESPIPE - the pending response remained intact after the rejected operations - a subsequent normal command/response cycle completed normally - no KASAN report was produced.","publishedAt":"2026-08-15T06:21:30","lastModifiedAt":"2026-08-17T06:18:13","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72135","cvssScore":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00164,"riskScore":0.79,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72135","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72135","en":"https://www.redsauce.net/en/cves/CVE-2026-72135","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72135","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72135","de":"https://www.redsauce.net/de/cves/CVE-2026-72135","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72135","el":"https://www.redsauce.net/el/cves/CVE-2026-72135"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72135"}}