CVE-2026-72135

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description TPM character devices expose a sequential command/response interface, but their open handlers incorrectly leave FMODE PREAD and FMODE PWRITE enabled. When a command leaves a response pending, using pread() with a large offset passes an unchecked value to the tpm common read() function. This can lead to an out-of-bounds heap read via copy to user() and a subsequent out-of-bounds zero-write through memset(). Positional I/O is incompatible with this interface because an arbitrary offset cannot accurately represent the sequential consumption of a response, and pwrite() fails to update the f pos cursor, potentially leaving it stale.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.