CVE-2026-72135

In the Linux kernel, the following vulnerability has been resolved:

tpm: Make the TPM character devices non-seekable

The TPM character devices expose a sequential command/response interface, but their open handlers leave FMODEPREAD and FMODEPWRITE enabled.

After a command leaves a response pending, pread(fd, buf, 16, 0x1400) passes 0x1400 as *off to tpmcommonread(). The transfer length is bounded by responselength, but the offset is used unchecked when forming databuffer + *off. A sufficiently large offset therefore causes an out-of-bounds heap read through copytouser() and, if the copy succeeds, an out-of-bounds zero-write through the following memset().

Positional I/O does not provide coherent semantics for this interface. An arbitrary pread offset cannot represent how much of a response has been consumed sequentially. The write callback always stores a command at the start of databuffer, while pwrite() does not update file->fpos and can leave the sequential read cursor stale.

Call nonseekableopen() from both open handlers. This removes FMODEPREAD and FMODEPWRITE, causing positional reads and writes to fail with -ESPIPE before reaching the TPM callbacks, and explicitly marks the files non-seekable. Normal read() and write() continue to use the existing sequential fpos cursor, leaving the response state machine unchanged.

Tested on Linux 6.12 with KASAN and a swtpm TPM2 device:

• sequential partial reads returned the complete response
• pread() and preadv() with offset 0x1400 returned -ESPIPE
• pwrite() and pwritev() with offset zero returned -ESPIPE
• the pending response remained intact after the rejected operations
• a subsequent normal command/response cycle completed normally
• no KASAN report was produced.