$ the-wire · showcase
TPM DEVICE HEAP READ VULNERABILITY CLOSES, STAGING AND USB FIXES LAND
By RepoJournal · Filed · About Linux · Composed from the cited sources · methodology
The kernel just closed a critical TPM character device vulnerability that could leak heap memory through seekable file offsets, while rc3 merges sweep in fixes across staging, USB, s390, and tracing subsystems.
Linux kernel maintainers fixed a dangerous out-of-bounds heap read in TPM character devices by disabling seek operations [1]. The vulnerability allowed attackers to pass arbitrary offsets to tpm_common_read(), bypassing response_length bounds checks and exposing sensitive kernel memory. This was a clean security win: the TPM interface is inherently sequential, so seeking made no sense anyway.
Greg KH merged staging driver fixes targeting rtl8723bs WiFi and vme_user validation bugs [2], followed immediately by a larger USB subsidy pull addressing serial driver use-after-free issues, gadget rndis exploits from malicious hosts, and typec driver regressions [3]. These aren't show-stoppers individually but they've been accumulating in rc3. S390 also landed speculative execution mitigations in diag310 and fixed alignment mask truncation bugs .
Steven Rostedt's tracing fixes address a synthetic event memory leak in the error path and a subtle ring_buffer_event_length() bug on 8-byte aligned architectures [4]. On the archinstall side, type checking coverage expanded for test code while Vietnamese language support reached 61% translation [5] [6].
Action items
- → Review TPM device changes [ref:1] if you maintain security-sensitive code paths torvalds/linux [plan]
- → Test rc3 merges on USB and staging hardware before production kernel builds torvalds/linux [monitor]
- → Watch tracing subsystem for ring_buffer correctness on 8-byte aligned platforms torvalds/linux [monitor]
References
- [1] tpm: Make the TPM character devices non-seekable torvalds/linux ↗
- [2] Merge tag 'staging-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging torvalds/linux ↗
- [3] Merge tag 'usb-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb torvalds/linux ↗
- [4] Merge tag 'trace-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace torvalds/linux ↗
- [5] Enable more mypy and Pylint checks for test_tooling/ ↗ archlinux/archinstall
- [6] Add Vietnamese to Archinstall ↗ archlinux/archinstall
