Linux EFI: unaccepted-memory table under-reserved, panicking large Intel TDX guests

Impact

reserve_unaccepted() aligned the size of the EFI unaccepted-memory table but ignored a non-page-aligned start address, so when the table straddled an extra page the tail was left unreserved and could be overwritten or become inaccessible, leading to a kernel panic in accept_memory(). The commit says this was observed booting Intel TDX VMs with more than about 64 GB of memory - exactly the shape of a confidential-computing guest an operator would run for a tenant that wants memory encryption. The failure is a guest boot-time panic, not a breach of TDX isolation; nothing in the record describes attestation or confidentiality being broken. For an operator the cost is confidential VMs that will not come up reliably at realistic memory sizes.

Who can reach it

No attacker is required: the bug fires on boot of a TDX guest whose unaccepted-memory table lands at an unaligned address, which depends on firmware memory layout and guest size. Reaching it deliberately would require control over the guest's memory configuration or the virtual firmware.

What to do

Update the guest kernel to a stable release carrying the fix (compute the end address before aligning up); five stable commits are linked, including the 6.6 branch. Each affected confidential VM needs the new kernel and a reboot; host kernels not used as TDX guests are unaffected. No workaround is given other than avoiding the memory sizes that trigger it.

References

Related entries

• Linux kernel crypto authencesn: out-of-bounds access with a 1-3 byte ahash digest via AF_ALGCVE-2026-46033 · Linux kernel crypto authencesn (ahash digest size validation)High
• Linux kernel (drivers/iommu/intel): Killing a VM that has a device attached through the VT-d nested/PASID path makesCVE-2026-52953 · Linux kernel (drivers/iommu/intel)High
• Linux kernel BPF: out-of-bounds read copying unaligned cgroup-storage values into a per-CPU mapCVE-2026-53076 · Linux kernel BPF (pcpu_init_value, per-CPU map element copy)High
• Linux kernel (virt/kvm): A guest store that splits a page and lands on a datamatch-enabled ioeventfd reaches a BUG_ONCVE-2026-63806 · Linux kernel (virt/kvm)High
• Linux KVM/SVM - AVIC IPI virtualization on Hygon Family 18h: AVIC inter-processor-interrupt virtualization is unsafe onCVE-2026-64172 · Linux KVM/SVM - AVIC IPI virtualization on Hygon Family 18hHigh
• Linux iommu/amd: signed offset parsing in IOMMU debugfs allowed a latent out-of-bounds accessCVE-2026-64186 · Linux kernel AMD IOMMU debugfs interface (iommu_mmio_write, iommu_capability_write)High