Linux kernel TPM character device pread() out-of-bounds read
TPM character devices were registered with seekable file operations, allowing pread() with an arbitrary offset to read past the response buffer in tpm_common_read().
- Vendor
- Linux Kernel
- Product
- Linux kernel (TPM character device — /dev/tpm0, /dev/tpmrm0)
- CVSS
- N/A
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
TPM character devices expose a sequential command-response interface but were opened with FMODE_PREAD and FMODE_PWRITE enabled. tpm_common_read() correctly bounded the transfer length against response_length, but formed the source pointer as data_buffer + *off without validating *off. A caller issuing pread() with an offset past the response buffer produced an out-of-bounds kernel memory read.
Exploitation requires access to a TPM character device, which is not root-only in configurations granting service accounts TPM access (common in attestation and key management deployments). The information leak is bounded by the response buffer layout in the surrounding kernel memory. No exploitation reported.
The fix calls nonseekable_open() in the TPM character device open handler, marking the file descriptor non-seekable and rejecting pread()/pwrite() calls at the VFS layer. No CVSS score assigned by NVD as of publication. Update to the current Linux stable release.
Source: kernel.org stable commit. Published on NVD 2026-08-15.
