CVE-2026-72135 Linux CVE debrief

Who should care

Linux kernel users and administrators, especially those using TPM character devices, should be aware of the vulnerability and take necessary precautions to protect their systems. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and planning vendor-supported updates or mitigations through normal change control where exposure is confirmed. Additionally, they should review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need extra review. Affected operator, platform, vulnerability-management, and security-team impact should be carefully evaluated to ensure proper mitigation and remediation efforts are in place. Those responsible for maintaining and securing Linux kernel systems need to prioritize this vulnerability and take immediate action to prevent exploitation. This may involve coordinating with vendors, applying patches, and implementing additional security measures to protect against potential attacks. By taking proactive steps, Linux kernel users and administrators can help prevent the exploitation of this vulnerability and minimize potential damage. Furthermore, it is crucial to verify the integrity of the TPM character devices and ensure that they are properly configured to prevent unauthorized access. This can be achieved by implementing compensating controls, such as monitoring and exception tracking, and verifying the integrity of the TPM character devices. Linux kernel users and administrators should also consider conducting regular security audits and risk assessments to identify potential vulnerabilities and prioritize remediation efforts accordingly. By doing so, they can help ensure the security and integrity of their systems and prevent potential attacks. Finally, it is essential to stay informed about the latest security advisories and updates, and to participate in vulnerability management and remediation efforts to ensure the security of Linux kernel systems. This includes staying up-to-date with the latest patches and updates, and implementing security措施

Technical summary

The Linux kernel vulnerability CVE-2026-72135 allows for an out-of-bounds heap read and write through the TPM character devices. The vulnerability arises from the devices' open handlers leaving FMODE_PREAD and FMODE_PWRITE enabled, enabling sequential command/response interfaces. A large offset in pread() can cause an out-of-bounds read and write. The issue is resolved by calling nonseekable_open() from both open handlers, removing FMODE_PREAD and FMODE_PWRITE, and marking the files as non-seekable.

Defensive priority

High

Recommended defensive actions

• Inventory affected systems and apply the vendor remediation
• Implement compensating controls, such as monitoring and exception tracking
• Verify the integrity of the TPM character devices
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was resolved by making the TPM character devices non-seekable. Testing was performed on Linux 6.12 with KASAN and a swtpm TPM2 device. The test results confirmed that sequential partial reads returned the complete response, pread() and preadv() with offset 0x1400 returned -ESPIPE, and pwrite() and pwritev() with offset zero returned -ESPIPE.

Official resources