CVE-2026-72135

A flaw was found in the Linux kernel's Trusted Platform Module (TPM) character devices. These devices, intended for sequential command processing, incorrectly allow positional input/output (I/O) operations. A local attacker can exploit this by using a large offset in a positional read operation, leading to an out-of-bounds read from the heap. This could result in the disclosure of sensitive information or, through an out-of-bounds write, cause data corruption or a system crash.

This vulnerability is rated as having Moderate impact because exploitation requires local access with explicit permissions to interact with TPM character device nodes, which are restricted by default to privileged users and the tss group on Red Hat Enterprise Linux. An authenticated attacker possessing read and write access to these device interfaces can trigger non-sequential I/O operations to induce out-of-bounds kernel heap memory access. While successful exploitation could lead to kernel memory disclosure, corruption, or a system crash, it cannot be triggered remotely or by unprivileged accounts lacking access to the TPM interface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.