Intel TDX MigTD: SPDM responder fails to separate internal states, allowing data corruption

CVSS 6.8CVE-2026-57893Firmware, BMC & network fabriccurated

Impact

MigTD's SPDM responder does not keep its internal protocol states fully apart. SPDM is the protocol that authenticates and secures the migration session. A privileged adversary can use this to corrupt data (high integrity impact; no confidentiality or availability impact listed). This is the only MigTD issue in INTEL-SA-01580 scored as adjacent rather than local, which suggests it can be reached over the migration channel between hosts. On TDX hosts that live-migrate confidential VMs, it weakens the integrity guarantee of the migration path.

Who can reach it

Adjacent network, high privilege: a privileged system-software adversary who can reach the MigTD SPDM session, for example on the migration network between TDX hosts. No user interaction needed.

What to do

Update MigTD as described in Intel advisory INTEL-SA-01580. The record names no fixed version. Fleets that do not use TDX live migration with MigTD are not exposed.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-57893 https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.