Intel TDX MigTD: use-after-free in the virtio driver lets privileged host software corrupt data

Impact

MigTD has a use-after-free in its virtio driver, the device interface the host provides to it. Privileged host software can trigger it to corrupt data inside MigTD (high integrity impact) and cause limited disruption (low availability impact). Because MigTD carries confidential VMs during live migration, a host that is supposed to be untrusted gains a way to tamper with that path. The record does not say what can be corrupted.

Who can reach it

Local, high privilege: an attacker who controls host system software (hypervisor/VMM level) on a TDX-enabled host. No user interaction needed.

What to do

Update MigTD as described in Intel advisory INTEL-SA-01580. The record names no fixed version. Fleets that do not use TDX live migration with MigTD are not exposed.

References

Related entries

• AMI Aptio V BIOS: out-of-bounds write during firmware update processingCVE-2026-66334 · AMI Aptio V BIOS (firmware update processing)Medium
• AMI Aptio V BIOS: heap-based buffer overflow during firmware update processingCVE-2026-66335 · AMI Aptio V BIOS (firmware update processing)Medium
• Dell OMSA: improper certificate validation allows adjacent-network interception of management trafficCVE-2026-81447 · Dell OpenManage Server Administrator (TLS certificate validation)Medium
• Dell OpenManage Enterprise: improper signature verification allows code execution by an adminCVE-2026-91908 · Dell OpenManage Enterprise (cryptographic signature verification)Medium
• Dell OpenManage Enterprise: unsanitized output injects script into a downstream componentCVE-2026-91915 · Dell OpenManage Enterprise (injection into a downstream component)Medium
• OpenBMC bmcweb mTLS client-certificate UPN validation: Where mTLS is configured, bmcweb matches the certificate's UPNNCVD-2026-004-openbmc-bmcweb-mtls-client-certi · OpenBMC bmcweb mTLS client-certificate UPN validationMedium