CVE-2026-72135: In the Linux kernel, the following vulnerability has been resolved: tpm: Make the TPM character devices non-seekable T
Summary
A vulnerability in Linux kernel TPM (Trusted Platform Module, a security chip) character devices allowed attackers to read or write memory outside intended bounds by using positional I/O operations (pread/pwrite) with large offsets, potentially causing crashes or information leaks. The kernel was leaving these devices seekable (able to jump to arbitrary positions) when they should only support sequential access.
Solution / Mitigation
Call nonseekable_open() from both TPM device open handlers. This removes positional read/write flags (FMODE_PREAD and FMODE_PWRITE), causing pread() and pwrite() to fail with -ESPIPE (an error code meaning the operation is not supported on this file type) before reaching vulnerable code, while preserving normal sequential read() and write() functionality.
Vulnerability Details
EPSS: 0.0%
August 15, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-72135
First tracked: August 15, 2026 at 08:08 AM
Classified by LLM (prompt v3) · confidence: 95%