CVE-2026-20775: Intel TDX Module DoS Vulnerability

CVE-2026-20775 Overview

CVE-2026-20775 is an uncaught exception vulnerability [CWE-248] affecting certain Intel Trust Domain Extensions (TDX) modules operating within Ring 0: Trust Domain. A privileged system software adversary can trigger the exception through a high-complexity local attack, causing a denial of service. Exploitation requires local access and elevated privileges but no user interaction. The flaw impacts only availability. Confidentiality and integrity remain unaffected on both the vulnerable component and subsequent systems. Intel disclosed the issue in security advisory SA-01436.

Critical Impact
Successful exploitation causes denial of service against the affected Intel TDX module, disrupting Trust Domain workloads that rely on the confidential computing environment.

Affected Products

Intel Trust Domain Extensions (TDX) modules operating in Ring 0: Trust Domain
Refer to Intel Security Advisory SA-01436 for the specific affected module versions

Discovery Timeline

2026-08-11 - CVE-2026-20775 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-20775

Vulnerability Analysis

CVE-2026-20775 is an uncaught exception weakness [CWE-248] within Intel TDX modules that execute in Ring 0 of a Trust Domain. Intel TDX provides hardware-isolated virtual machines (Trust Domains) that shield guest memory and CPU state from the host hypervisor. The TDX module mediates transitions between the host and Trust Domains and enforces isolation guarantees.

When the module encounters an unexpected condition it fails to catch, control flow terminates abnormally. This halts the module's ability to service the Trust Domain, producing a denial of service against confidential workloads that depend on TDX.

Root Cause

The root cause is a missing exception handler within the TDX module. Specific inputs or state transitions raise an exception that no handler catches, causing abnormal termination of the module operation. Because the module runs at Ring 0 within the Trust Domain, the failure directly impacts the availability of the confidential computing environment.

Attack Vector

Exploitation requires local access, high attack complexity, and high privileges on the affected system. An adversary with privileged system software access can trigger the uncaught exception when specific attack requirements are present. No user interaction is needed. The vulnerability yields only an availability impact; there is no path to information disclosure or code execution through this flaw.

See Intel Security Advisory SA-01436 for module-level technical details.

Detection Methods for CVE-2026-20775

Indicators of Compromise

Unexpected termination or reset of Intel TDX modules and Trust Domain guests
Hypervisor logs recording TDX module fault events or abnormal VM exits from Trust Domains
Repeated Trust Domain crashes correlated with activity from privileged local accounts

Detection Strategies

Monitor host kernel and hypervisor telemetry for TDX module error codes and abnormal Trust Domain terminations
Correlate Trust Domain crash events with privileged user sessions to identify potential abuse
Track invocations of TDX SEAMCALL interfaces originating from unexpected host software components

Monitoring Recommendations

Forward hypervisor, kernel, and TDX-related event logs to a centralized SIEM for correlation
Alert on unexplained restarts or availability loss of confidential workloads running inside Trust Domains
Baseline normal TDX module behavior and flag deviations tied to privileged local activity

How to Mitigate CVE-2026-20775

Immediate Actions Required

Inventory systems using Intel TDX and identify affected TDX module versions listed in Intel SA-01436
Restrict privileged local access to hosts running Trust Domains to trusted administrators only
Apply the updated Intel TDX module as soon as it is validated in your environment

Patch Information

Intel published remediation guidance in Intel Security Advisory SA-01436. Administrators should deploy the fixed TDX module version identified in the advisory and follow platform vendor instructions for loading the updated module.

Workarounds

Limit host administrator accounts and enforce strong authentication for any user with privileged system software access
Isolate hosts running Trust Domains from general-purpose workloads to reduce local attack surface
Monitor for abnormal TDX module behavior until the vendor-supplied module update is deployed

bash

# Verify Intel TDX module status on a Linux host (example)
dmesg | grep -i tdx
cat /sys/firmware/tdx/tdx_module/version 2>/dev/null || echo "TDX module info not exposed"