Intel TDX MigTD: vmcall_raw transport detects errors but does not act on them, allowing data corruption

CVSS 5.6CVE-2026-62275Firmware, BMC & network fabriccurated

Impact

MigTD's vmcall_raw transport, a channel between MigTD and the host VMM, notices some error conditions and then carries on anyway. Privileged host software can use this to corrupt data inside MigTD (high integrity impact). Exploitation needs specific attack requirements to be present (AT:P), so it is harder to hit than its sibling issues in the same advisory. The record does not describe those requirements or what data is affected.

Who can reach it

Local, high privilege: an attacker who controls host system software on a TDX-enabled host, and only when certain conditions hold. No user interaction needed.

What to do

Update MigTD as described in Intel advisory INTEL-SA-01580. The record names no fixed version. Fleets that do not use TDX live migration with MigTD are not exposed.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-62275 https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.