CVE-2026-72135

Received Received - Intake

Heap Buffer Overflow in Linux Kernel TPM Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tpm: Make the TPM character devices non-seekable The TPM character devices expose a sequential command/response interface, but their open handlers leave FMODE_PREAD and FMODE_PWRITE enabled. After a command leaves a response pending, pread(fd, buf, 16, 0x1400) passes 0x1400 as *off to tpm_common_read(). The transfer length is bounded by response_length, but the offset is used unchecked when forming data_buffer + *off. A sufficiently large offset therefore causes an out-of-bounds heap read through copy_to_user() and, if the copy succeeds, an out-of-bounds zero-write through the following memset(). Positional I/O does not provide coherent semantics for this interface. An arbitrary pread offset cannot represent how much of a response has been consumed sequentially. The write callback always stores a command at the start of data_buffer, while pwrite() does not update file->f_pos and can leave the sequential read cursor stale. Call nonseekable_open() from both open handlers. This removes FMODE_PREAD and FMODE_PWRITE, causing positional reads and writes to fail with -ESPIPE before reaching the TPM callbacks, and explicitly marks the files non-seekable. Normal read() and write() continue to use the existing sequential f_pos cursor, leaving the response state machine unchanged. Tested on Linux 6.12 with KASAN and a swtpm TPM2 device: - sequential partial reads returned the complete response - pread() and preadv() with offset 0x1400 returned -ESPIPE - pwrite() and pwritev() with offset zero returned -ESPIPE - the pending response remained intact after the rejected operations - a subsequent normal command/response cycle completed normally - no KASAN report was produced.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72135

EUVD

EUVD-2026-58893

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.12 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves the TPM (Trusted Platform Module) character devices. The issue occurs because these devices allow positional reads and writes (pread/pwrite) which can lead to out-of-bounds memory access. By making the devices non-seekable, the kernel prevents these unsafe operations while maintaining normal sequential read/write functionality.

Detection Guidance

This vulnerability is specific to the Linux kernel's TPM character device handling. Detection requires checking if the kernel version is vulnerable and if the TPM device is exposed. Check your kernel version with 'uname -r' and verify if the TPM device is accessible via '/dev/tpm*' or similar paths. No direct commands detect the vulnerability itself, but kernel logs may show related errors if exploited.

Impact Analysis

An attacker could exploit this flaw to read or write memory outside the intended buffer in the kernel. This could lead to crashes, data corruption, or potentially privilege escalation if combined with other vulnerabilities. Normal users interacting with TPM devices would not notice any change except that positional I/O operations will fail.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level kernel issue in the TPM character device interface that could lead to out-of-bounds memory access. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Apply the kernel patch that removes FMODE_PREAD and FMODE_PWRITE from TPM character devices by ensuring 'nonseekable_open()' is called in open handlers. Update your Linux kernel to a version containing this fix. If immediate patching is not possible, restrict access to TPM devices via permissions or disable them if unused.

Hi! I’m here to help you understand CVE-2026-72135. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70