Intel TDX Guest software: incorrect comparison lets a privileged local actor escalate inside a TD guest

CVSS 4.6CVE-2026-20765Firmware, BMC & network fabriccurated

Impact

Guest-side Intel TDX software before 0.3.1 performs an incorrect comparison in user-space components, which Intel states may allow escalation of privilege for a local, already-privileged actor. Where confidential computing is used to isolate tenant workloads on accelerated hosts, this is a weakening inside the trust domain the tenant is paying for, not a break of the host-to-guest boundary. Intel rates the impact low across confidentiality, integrity and availability with no subsequent-system impact, and the record does not name the specific component or the escalation path. Nothing in the record indicates the host, the hypervisor or another tenant's TD can reach it.

Who can reach it

Local access inside the trust domain with a privileged (administrative) account in the guest; no user interaction. Not reachable across the network or from another tenant.

What to do

Update Intel TDX Guest software to version 0.3.1 or later per INTEL-SA-01462. This is a guest-side package update: refresh the confidential-VM image or update in place and restart the affected trust domains. Intel's record describes no microcode update, BIOS flash or host reboot for this issue, and does not list a mitigation for unpatched guests.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-20765 https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01462.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.