CVE-2026-72135
tpm: Make the TPM character devices non-seekable
Description
In the Linux kernel, the following vulnerability has been resolved: tpm: Make the TPM character devices non-seekable The TPM character devices expose a sequential command/response interface, but their open handlers leave FMODE_PREAD and FMODE_PWRITE enabled. After a command leaves a response pending, pread(fd, buf, 16, 0x1400) passes 0x1400 as *off to tpm_common_read(). The transfer length is bounded by response_length, but the offset is used unchecked when forming data_buffer + *off. A sufficiently large offset therefore causes an out-of-bounds heap read through copy_to_user() and, if the copy succeeds, an out-of-bounds zero-write through the following memset(). Positional I/O does not provide coherent semantics for this interface. An arbitrary pread offset cannot represent how much of a response has been consumed sequentially. The write callback always stores a command at the start of data_buffer, while pwrite() does not update file->f_pos and can leave the sequential read cursor stale. Call nonseekable_open() from both open handlers. This removes FMODE_PREAD and FMODE_PWRITE, causing positional reads and writes to fail with -ESPIPE before reaching the TPM callbacks, and explicitly marks the files non-seekable. Normal read() and write() continue to use the existing sequential f_pos cursor, leaving the response state machine unchanged. Tested on Linux 6.12 with KASAN and a swtpm TPM2 device: - sequential partial reads returned the complete response - pread() and preadv() with offset 0x1400 returned -ESPIPE - pwrite() and pwritev() with offset zero returned -ESPIPE - the pending response remained intact after the rejected operations - a subsequent normal command/response cycle completed normally - no KASAN report was produced.
INFO
Published Date :
Aug. 15, 2026, 6:21 a.m.
Last Modified :
Aug. 17, 2026, 6:18 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Update the Linux kernel to include the nonseekable_open() fix.
- Verify the patch prevents positional I/O errors.
- Ensure kernel updates are applied promptly.
- Monitor for further security advisories.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-72135.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-72135 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-72135
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-72135 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-72135 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 17, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': 'ed0ffc2c016629e40ba041ed0424a772d8b02e2c', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': '232dcf908eb7eb9d8046a9597975caf44270966e', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': 'dda695fab5e21f923d29e8cb01df256468ddfbd1', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': '9c513dabd4540f811585a2087f23069767a284da', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': '21a13f932972bc9836f58c44fcd47c62abdecd95', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': 'ada4b9a5087ea7f30dd8e4c6411a4fb6547eb1ed', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': '947b773caaa548672184df025271b29bdc80b0f1', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': 'f20d61c22bcaf172d6790b6500e3838e532e71c8', 'versionType': 'git'}], 'programFiles': ['drivers/char/tpm/tpm-dev.c', 'drivers/char/tpm/tpmrm-dev.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.0'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.0', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc3', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/char/tpm/tpm-dev.c', 'drivers/char/tpm/tpmrm-dev.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': 'ed0ffc2c016629e40ba041ed0424a772d8b02e2c', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': '232dcf908eb7eb9d8046a9597975caf44270966e', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': 'dda695fab5e21f923d29e8cb01df256468ddfbd1', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': '9c513dabd4540f811585a2087f23069767a284da', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': '21a13f932972bc9836f58c44fcd47c62abdecd95', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': 'ada4b9a5087ea7f30dd8e4c6411a4fb6547eb1ed', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': '947b773caaa548672184df025271b29bdc80b0f1', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': 'f20d61c22bcaf172d6790b6500e3838e532e71c8', 'versionType': 'git'}], 'programFiles': ['drivers/char/tpm/tpm-dev.c', 'drivers/char/tpm/tpmrm-dev.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.0'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.0', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/char/tpm/tpm-dev.c', 'drivers/char/tpm/tpmrm-dev.c'], 'defaultStatus': 'affected'}] -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 15, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': 'ed0ffc2c016629e40ba041ed0424a772d8b02e2c', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': '232dcf908eb7eb9d8046a9597975caf44270966e', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': 'dda695fab5e21f923d29e8cb01df256468ddfbd1', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': '9c513dabd4540f811585a2087f23069767a284da', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': '21a13f932972bc9836f58c44fcd47c62abdecd95', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': 'ada4b9a5087ea7f30dd8e4c6411a4fb6547eb1ed', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': '947b773caaa548672184df025271b29bdc80b0f1', 'versionType': 'git'}, {'status': 'affected', 'version': '9488585b21bef0df1217e510c7134905d1d376a7', 'lessThan': 'f20d61c22bcaf172d6790b6500e3838e532e71c8', 'versionType': 'git'}], 'programFiles': ['drivers/char/tpm/tpm-dev.c', 'drivers/char/tpm/tpmrm-dev.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.0'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.0', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc3', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/char/tpm/tpm-dev.c', 'drivers/char/tpm/tpmrm-dev.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: tpm: Make the TPM character devices non-seekable The TPM character devices expose a sequential command/response interface, but their open handlers leave FMODE_PREAD and FMODE_PWRITE enabled. After a command leaves a response pending, pread(fd, buf, 16, 0x1400) passes 0x1400 as *off to tpm_common_read(). The transfer length is bounded by response_length, but the offset is used unchecked when forming data_buffer + *off. A sufficiently large offset therefore causes an out-of-bounds heap read through copy_to_user() and, if the copy succeeds, an out-of-bounds zero-write through the following memset(). Positional I/O does not provide coherent semantics for this interface. An arbitrary pread offset cannot represent how much of a response has been consumed sequentially. The write callback always stores a command at the start of data_buffer, while pwrite() does not update file->f_pos and can leave the sequential read cursor stale. Call nonseekable_open() from both open handlers. This removes FMODE_PREAD and FMODE_PWRITE, causing positional reads and writes to fail with -ESPIPE before reaching the TPM callbacks, and explicitly marks the files non-seekable. Normal read() and write() continue to use the existing sequential f_pos cursor, leaving the response state machine unchanged. Tested on Linux 6.12 with KASAN and a swtpm TPM2 device: - sequential partial reads returned the complete response - pread() and preadv() with offset 0x1400 returned -ESPIPE - pwrite() and pwritev() with offset zero returned -ESPIPE - the pending response remained intact after the rejected operations - a subsequent normal command/response cycle completed normally - no KASAN report was produced. Added Reference https://git.kernel.org/stable/c/21a13f932972bc9836f58c44fcd47c62abdecd95 Added Reference https://git.kernel.org/stable/c/232dcf908eb7eb9d8046a9597975caf44270966e Added Reference https://git.kernel.org/stable/c/947b773caaa548672184df025271b29bdc80b0f1 Added Reference https://git.kernel.org/stable/c/9c513dabd4540f811585a2087f23069767a284da Added Reference https://git.kernel.org/stable/c/ada4b9a5087ea7f30dd8e4c6411a4fb6547eb1ed Added Reference https://git.kernel.org/stable/c/dda695fab5e21f923d29e8cb01df256468ddfbd1 Added Reference https://git.kernel.org/stable/c/ed0ffc2c016629e40ba041ed0424a772d8b02e2c Added Reference https://git.kernel.org/stable/c/f20d61c22bcaf172d6790b6500e3838e532e71c8