CVE-2025-31938: Intel Xeon 6 TDX Information Disclosure

CVE-2025-31938 Overview

CVE-2025-31938 is an information disclosure vulnerability affecting certain Intel Xeon 6 Scalable processors that support Intel Trust Domain Extensions (TDX). The flaw stems from insufficient granularity of access control in an internal subsystem, categorized under [CWE-1220]. An authenticated local adversary with specific internal knowledge can exploit this weakness to expose confidential data from a subsequent system. Intel disclosed the issue in Intel Security Advisory SA-01404.

Critical Impact
An authorized local user can trigger unintended data exposure from a subsequent trust boundary, undermining the confidentiality guarantees that Intel TDX is designed to provide for confidential virtual machines.

Affected Products

Intel Xeon 6 Scalable processors with Intel TDX enabled
Confidential computing workloads running inside Intel TDX Trust Domains
Cloud and on-premises platforms relying on TDX attestation for tenant isolation

Discovery Timeline

2026-08-11 - CVE-2025-31938 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2025-31938

Vulnerability Analysis

The vulnerability originates in an access control mechanism within a subsystem of affected Intel Xeon 6 Scalable processors that provide Intel TDX. Access control is enforced at a granularity that is insufficient to fully isolate confidential resources between security domains. As a result, an authenticated local user who already possesses low privileges on the host can, under specific conditions, observe data that should remain private to another system context.

Exploitation requires high attack complexity and depends on internal implementation knowledge of the affected subsystem. No user interaction is needed. The vulnerability does not directly impair the vulnerable system's own confidentiality, integrity, or availability, but a successful attack yields high confidentiality impact on a subsequent system, which in TDX deployments typically corresponds to a guest Trust Domain.

Root Cause

The root cause is classified as CWE-1220 (Insufficient Granularity of Access Control). Hardware or firmware policy in the affected subsystem does not distinguish finely enough between security contexts, allowing information tied to one context to become observable from another. In TDX environments, this weakens the isolation contract between the host, the TDX module, and guest Trust Domains.

Attack Vector

The attack vector is local. The adversary must be authenticated on the host platform with low-level privileges and must combine that access with specialized knowledge of the subsystem's internal behavior. No public proof-of-concept, exploit code, or Exploit-DB entry is available at the time of publication, and CISA has not added the CVE to the Known Exploited Vulnerabilities catalog.

See the Intel Security Advisory SA-01404 for authoritative product lists and firmware guidance. Because no verified public exploit code is available, no sample code is reproduced here.

Detection Methods for CVE-2025-31938

Indicators of Compromise

No public indicators of compromise have been published for CVE-2025-31938.
Unexpected data appearing in host-side telemetry that correlates with TDX guest memory contents should be treated as suspicious.
Unauthorized firmware or microcode changes on Intel Xeon 6 platforms warrant investigation.

Detection Strategies

Inventory Intel Xeon 6 Scalable processors and identify systems with TDX enabled, then cross-reference them against Intel SA-01404.
Validate microcode and BIOS versions against Intel's fixed releases on every affected host during boot-time attestation.
Monitor for unauthorized local logins or privilege changes on hypervisor hosts that provide TDX Trust Domains.

Monitoring Recommendations

Collect and retain platform attestation reports so that microcode regressions or downgrades are visible to the security team.
Alert on changes to TDX-related kernel modules, qemu launch parameters, or hypervisor configuration on affected hosts.
Forward host authentication logs and firmware update events to your SIEM for long-term correlation.

How to Mitigate CVE-2025-31938

Immediate Actions Required

Review Intel Security Advisory SA-01404 and identify affected Xeon 6 Scalable SKUs in your fleet.
Apply the microcode and platform firmware updates published by Intel and by your server or cloud vendor.
Restrict local, authenticated access to TDX-enabled hosts to a minimal set of administrators.
Re-run TDX attestation after patching to confirm Trust Domains launch on updated microcode.

Patch Information

Intel has published mitigations in Security Advisory SA-01404. Platform owners should obtain the corresponding BIOS, firmware, and microcode updates from their OEM or cloud provider. Confirm that the TDX module version referenced in the advisory is loaded before returning workloads to production.

Workarounds

Where patches cannot be applied immediately, avoid scheduling sensitive confidential-computing workloads on unpatched Intel Xeon 6 hosts.
Enforce strict role-based access control on hypervisor hosts to prevent low-privileged local accounts from interacting with the affected subsystem.
Increase monitoring of privileged host activity until firmware updates are deployed across the fleet.

bash

# Configuration example: verify microcode revision on a Linux host
grep -m1 'microcode' /proc/cpuinfo
dmesg | grep -i 'microcode\|tdx'
# Confirm TDX module version reported by the kernel matches the fixed release in Intel SA-01404