7.8
HIGH CVSS 3.1
CVE-2026-72135
tpm: Make the TPM character devices non-seekable
Description

In the Linux kernel, the following vulnerability has been resolved: tpm: Make the TPM character devices non-seekable The TPM character devices expose a sequential command/response interface, but their open handlers leave FMODE_PREAD and FMODE_PWRITE enabled. After a command leaves a response pending, pread(fd, buf, 16, 0x1400) passes 0x1400 as *off to tpm_common_read(). The transfer length is bounded by response_length, but the offset is used unchecked when forming data_buffer + *off. A sufficiently large offset therefore causes an out-of-bounds heap read through copy_to_user() and, if the copy succeeds, an out-of-bounds zero-write through the following memset(). Positional I/O does not provide coherent semantics for this interface. An arbitrary pread offset cannot represent how much of a response has been consumed sequentially. The write callback always stores a command at the start of data_buffer, while pwrite() does not update file->f_pos and can leave the sequential read cursor stale. Call nonseekable_open() from both open handlers. This removes FMODE_PREAD and FMODE_PWRITE, causing positional reads and writes to fail with -ESPIPE before reaching the TPM callbacks, and explicitly marks the files non-seekable. Normal read() and write() continue to use the existing sequential f_pos cursor, leaving the response state machine unchanged. Tested on Linux 6.12 with KASAN and a swtpm TPM2 device: - sequential partial reads returned the complete response - pread() and preadv() with offset 0x1400 returned -ESPIPE - pwrite() and pwritev() with offset zero returned -ESPIPE - the pending response remained intact after the rejected operations - a subsequent normal command/response cycle completed normally - no KASAN report was produced.

INFO

Published Date :

Aug. 15, 2026, 6:21 a.m.

Last Modified :

Aug. 17, 2026, 6:18 a.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products

The following products are affected by CVE-2026-72135 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 HIGH 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
Apply the kernel patch to prevent out-of-bounds reads and writes via character devices.
  • Update the Linux kernel to include the nonseekable_open() fix.
  • Verify the patch prevents positional I/O errors.
  • Ensure kernel updates are applied promptly.
  • Monitor for further security advisories.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-72135 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-72135 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-72135 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2026-72135 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 17, 2026

    Action Type Old Value New Value
    Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': 'ed0ffc2c016629e40ba041ed0424a772d8b02e2c', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': '232dcf908eb7eb9d8046a9597975caf44270966e', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': 'dda695fab5e21f923d29e8cb01df256468ddfbd1', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': '9c513dabd4540f811585a2087f23069767a284da', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': '21a13f932972bc9836f58c44fcd47c62abdecd95', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': 'ada4b9a5087ea7f30dd8e4c6411a4fb6547eb1ed', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': '947b773caaa548672184df025271b29bdc80b0f1', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': 'f20d61c22bcaf172d6790b6500e3838e532e71c8', 'versionType': 'git'}], 'programFiles': ['drivers/char/tpm/tpm-dev.c', 'drivers/char/tpm/tpmrm-dev.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.0'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.0', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc3', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/char/tpm/tpm-dev.c', 'drivers/char/tpm/tpmrm-dev.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': 'ed0ffc2c016629e40ba041ed0424a772d8b02e2c', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': '232dcf908eb7eb9d8046a9597975caf44270966e', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': 'dda695fab5e21f923d29e8cb01df256468ddfbd1', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': '9c513dabd4540f811585a2087f23069767a284da', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': '21a13f932972bc9836f58c44fcd47c62abdecd95', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': 'ada4b9a5087ea7f30dd8e4c6411a4fb6547eb1ed', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': '947b773caaa548672184df025271b29bdc80b0f1', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': 'f20d61c22bcaf172d6790b6500e3838e532e71c8', 'versionType': 'git'}], 'programFiles': ['drivers/char/tpm/tpm-dev.c', 'drivers/char/tpm/tpmrm-dev.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.0'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.0', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/char/tpm/tpm-dev.c', 'drivers/char/tpm/tpmrm-dev.c'], 'defaultStatus': 'affected'}]
  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 15, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': 'ed0ffc2c016629e40ba041ed0424a772d8b02e2c', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': '232dcf908eb7eb9d8046a9597975caf44270966e', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': 'dda695fab5e21f923d29e8cb01df256468ddfbd1', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': '9c513dabd4540f811585a2087f23069767a284da', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': '21a13f932972bc9836f58c44fcd47c62abdecd95', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': 'ada4b9a5087ea7f30dd8e4c6411a4fb6547eb1ed', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': '947b773caaa548672184df025271b29bdc80b0f1', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': 'f20d61c22bcaf172d6790b6500e3838e532e71c8', 'versionType': 'git'}], 'programFiles': ['drivers/char/tpm/tpm-dev.c', 'drivers/char/tpm/tpmrm-dev.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.0'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.0', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc3', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/char/tpm/tpm-dev.c', 'drivers/char/tpm/tpmrm-dev.c'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: tpm: Make the TPM character devices non-seekable The TPM character devices expose a sequential command/response interface, but their open handlers leave FMODE_PREAD and FMODE_PWRITE enabled. After a command leaves a response pending, pread(fd, buf, 16, 0x1400) passes 0x1400 as *off to tpm_common_read(). The transfer length is bounded by response_length, but the offset is used unchecked when forming data_buffer + *off. A sufficiently large offset therefore causes an out-of-bounds heap read through copy_to_user() and, if the copy succeeds, an out-of-bounds zero-write through the following memset(). Positional I/O does not provide coherent semantics for this interface. An arbitrary pread offset cannot represent how much of a response has been consumed sequentially. The write callback always stores a command at the start of data_buffer, while pwrite() does not update file->f_pos and can leave the sequential read cursor stale. Call nonseekable_open() from both open handlers. This removes FMODE_PREAD and FMODE_PWRITE, causing positional reads and writes to fail with -ESPIPE before reaching the TPM callbacks, and explicitly marks the files non-seekable. Normal read() and write() continue to use the existing sequential f_pos cursor, leaving the response state machine unchanged. Tested on Linux 6.12 with KASAN and a swtpm TPM2 device: - sequential partial reads returned the complete response - pread() and preadv() with offset 0x1400 returned -ESPIPE - pwrite() and pwritev() with offset zero returned -ESPIPE - the pending response remained intact after the rejected operations - a subsequent normal command/response cycle completed normally - no KASAN report was produced.
    Added Reference https://git.kernel.org/stable/c/21a13f932972bc9836f58c44fcd47c62abdecd95
    Added Reference https://git.kernel.org/stable/c/232dcf908eb7eb9d8046a9597975caf44270966e
    Added Reference https://git.kernel.org/stable/c/947b773caaa548672184df025271b29bdc80b0f1
    Added Reference https://git.kernel.org/stable/c/9c513dabd4540f811585a2087f23069767a284da
    Added Reference https://git.kernel.org/stable/c/ada4b9a5087ea7f30dd8e4c6411a4fb6547eb1ed
    Added Reference https://git.kernel.org/stable/c/dda695fab5e21f923d29e8cb01df256468ddfbd1
    Added Reference https://git.kernel.org/stable/c/ed0ffc2c016629e40ba041ed0424a772d8b02e2c
    Added Reference https://git.kernel.org/stable/c/f20d61c22bcaf172d6790b6500e3838e532e71c8
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.