Intel TDX MigTD: out-of-range pointer offset in virtio-vsock lets privileged host software escalate privilege

Impact

The MigTD virtio-vsock code, which carries data between MigTD and the host, uses a pointer offset outside its valid range. Privileged host software can use this to escalate privilege into MigTD. Intel rates confidentiality, integrity and availability impact on MigTD as high, with no impact on other systems. On a TDX fleet, code execution inside MigTD by the untrusted host undermines the migration protections for tenant TDs.

Who can reach it

Local privileged system software on the TDX host (VMM or host root) that controls the virtio-vsock device MigTD uses. Low complexity, no user interaction.

What to do

Apply the MigTD update named in Intel advisory INTEL-SA-01580. The record does not give a fixed version. Rollout cost depends on how your VMM stack deploys the MigTD image.

References

Related entries

• Intel TDX MigTD: expired pointer dereference in virtio-vsock lets privileged host software escalate privilegeCVE-2026-62929 · Intel TDX Migration Trust Domain (MigTD) - virtio-vsockHigh
• Intel TDX MigTD: write-what-where condition lets privileged host software escalate privilegeCVE-2026-60142 · Intel TDX Migration Trust Domain (MigTD)High
• Linux kernel (drivers/infiniband/core): IWARP port-mapper netlink attributes were accepted as plain strings with noCVE-2026-63860 · Linux kernel (drivers/infiniband/core)High
• AMI MegaRAC: Password reset interception via the API — attacker takes over an admin BMC accountCVE-2022-26872 · AMI MegaRACHigh
• AMI MegaRAC: Default credentials — Redfish API accessible with shipped accountCVE-2022-40259 · AMI MegaRACHigh
• Lenovo XClarity Controller (XCC) - API privilege escalation: A read-only XCC user gains elevated privileges throughCVE-2023-0683 · Lenovo XClarity Controller (XCC) - API privilege escalationHigh