igvm

igvm This project is the home of the Independent Guest Virtual Machine IGVM file format. The format specification can be found in the igvmdefs crate, with a Rust implementation of the binary format in the igvm crate. The IGVM file format is designed to encapsulate all information required to laun...

cvmimage

Tinfoil Confidential VM Tinfoil CVM is a confidential virtual machine for secure inference and custom compute workloads on AMD SEV-SNP and Intel TDX. Every byte of the final image is explicitly declared and derived from pinned inputs, the hermetic build is byte-for-byte reproducible, and anyone c...

CVE-2026-121876

A flaw was found in the interaction between systemd-gpt-auto-generator and confidential computing guest VM images in OpenShift Sandboxed Containers confidential peer pods. systemd-gpt-auto-generator automatically discovers and mounts GPT partitions by type GUID at boot with no user confirmation. ...

EUVD-2026-124550

A flaw was found in the interaction between systemd-gpt-auto-generator and confidential computing guest VM images in OpenShift Sandboxed Containers confidential peer pods. systemd-gpt-auto-generator automatically discovers and mounts GPT partitions by type GUID at boot with no user confirmation. ...

CVE-2026-121876 Sandboxed-containers: kernel: systemd-gpt-auto-generator: guest data leakage in confidential computing (sandboxed containers)

A flaw was found in the interaction between systemd-gpt-auto-generator and confidential computing guest VM images in OpenShift Sandboxed Containers confidential peer pods. systemd-gpt-auto-generator automatically discovers and mounts GPT partitions by type GUID at boot with no user confirmation. ...

CVE-2026-121876

A flaw exists in the interaction between systemd-gpt-auto-generator and confidential computing guest VM images in OpenShift Sandboxed Containers (confidential peer pods). The generator automatically discovers and mounts GPT partitions by type GUID at boot without user confirmation. In a confident...

CVE-2026-121876

A flaw was found in the interaction between systemd-gpt-auto-generator and confidential computing guest VM images in OpenShift Sandboxed Containers confidential peer pods. systemd-gpt-auto-generator automatically discovers and mounts GPT partitions by type GUID at boot with no user confirmation. ...

PT-2026-145869

A flaw was found in the interaction between systemd-gpt-auto-generator and confidential computing guest VM images in OpenShift Sandboxed Containers confidential peer pods. systemd-gpt-auto-generator automatically discovers and mounts GPT partitions by type GUID at boot with no user confirmation. ...

kernel: virt: tdx-guest: Just leak decrypted memory on unrecoverable errors

A flaw was found in the Linux kernel's Intel Trust Domain Extensions TDX guest driver used in confidential computing virtual machines. An untrusted host hypervisor can induce unrecoverable errors during memory decryption, causing the guest kernel to return shared, unencrypted memory back into the...

CVE-2026-62920

Unchecked return value in the MigTD error handling for the IntelR TDX Migration Trust Domain MigTD within Ring 0: Hypervisor may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable denial of service. This result may...

CVE-2026-63027

Incorrect behavior order in the gettcblevelbysvn for the IntelR TDX Migration Trust Domain MigTD within Ring 0: Hypervisor may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially...

CVE-2026-61468

Improper privilege management in the MigTD logging for the IntelR TDX Migration Trust Domain MigTD within Ring 0: Hypervisor may allow an information disclosure. System software adversary with a privileged user combined with a low complexity attack may enable data exposure. This result may...

CVE-2026-62275

Detection of error condition without action in the MigTD's vmcallraw transport for the IntelR TDX Migration Trust Domain MigTD within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable data...

CVE-2026-61467

Use after free in the MigTD virtio driver for the IntelR TDX Migration Trust Domain MigTD within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable data corruption. This result may potentially...

CVE-2026-61469

Off-by-one error in the MigTD's vmcallraw transport for the IntelR TDX Migration Trust Domain MigTD within Ring 0: Hypervisor may allow a denial of service. System software adversary with an unauthenticated user combined with a low complexity attack may enable data corruption. This result may...

CVE-2026-61470

Improper control of a resource through its lifetime in the MigTD's TLS client for the IntelR TDX Migration Trust Domain MigTD within Ring 0: Hypervisor may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable data corruption...

CVE-2026-61887

Missing critical step in authentication in the MigTD SPDM rebind implementation for the IntelR TDX Migration Trust Domain MigTD within Ring 0: Hypervisor may allow an escalation of privilege and information disclosure. Network adversary with an unauthenticated user combined with a low complexity...

CVE-2026-61473

Authentication bypass by capture-replay in the MigTD for the IntelR TDX Migration Trust Domain MigTD within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This resu...

CVE-2026-60139

Improper neutralization in the MigTD SPDM transport for the IntelR TDX Migration Trust Domain MigTD within Ring 0: Hypervisor may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potential...

CVE-2026-61377

Sensitive information uncleared in resource before release for reuse in the MigTD for the IntelR TDX Migration Trust Domain MigTD within Ring 0: Hypervisor may allow an information disclosure. System software adversary with a privileged user combined with a high complexity attack may enable data...