The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - tpm: Make the TPM character devices non-seekable The TPM character devices expose a sequential     command/response interface, but their open handlers leave FMODE_PREAD and FMODE_PWRITE enabled. After a     command leaves a response pending, pread(fd, buf, 16, 0x1400) passes 0x1400 as *off to tpm_common_read().
    The transfer length is bounded by response_length, but the offset is used unchecked when forming     data_buffer + *off. A sufficiently large offset therefore causes an out-of-bounds heap read through     copy_to_user() and, if the copy succeeds, an out-of-bounds zero-write through the following memset().
    Positional I/O does not provide coherent semantics for this interface. An arbitrary pread offset cannot     represent how much of a response has been consumed sequentially. The write callback always stores a     command at the start of data_buffer, while pwrite() does not update file->f_pos and can leave the     sequential read cursor stale. Call nonseekable_open() from both open handlers. This removes FMODE_PREAD     and FMODE_PWRITE, causing positional reads and writes to fail with -ESPIPE before reaching the TPM     callbacks, and explicitly marks the files non-seekable. Normal read() and write() continue to use the     existing sequential f_pos cursor, leaving the response state machine unchanged. Tested on Linux 6.12 with     KASAN and a swtpm TPM2 device: - sequential partial reads returned the complete response - pread() and     preadv() with offset 0x1400 returned -ESPIPE - pwrite() and pwritev() with offset zero returned -ESPIPE -     the pending response remained intact after the rejected operations - a subsequent normal command/response     cycle completed normally - no KASAN report was produced. (CVE-2026-72135)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-72135

high Nessus Plugin ID 337177

Version 1.2

Version 1.1

Version 1.2 Aug 20, 2026, 8:09 AM CVSS metrics ("CVSSv2 score" set to 6.8) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C") CVSSv2 severity (based on CVE-2026-72135, severity decreased from "High" to "Medium") Plugin Feed: 202608200809
Version 1.1 Aug 18, 2026, 3:38 PM New Plugin Feed: 202608181538