CVE-2026-21444: Libtpms Information Disclosure Flaw

CVE-2026-21444 Overview

CVE-2026-21444 affects libtpms, a library providing software emulation of a Trusted Platform Module (TPM). The flaw resides in versions 0.10.0 and 0.10.1 of the library when integrated with OpenSSL 3.x. The integration layer returns the initial initialization vector (IV) instead of the final IV after symmetric cipher operations. This breaks the chaining property of subsequent encryption and decryption steps, weakening confidentiality of data protected by the TPM emulator. The issue is tracked under CWE-327: Use of a Broken or Risky Cryptographic Algorithm and is fixed in version 0.10.2.

Critical Impact
Symmetric encryption operations performed through libtpms 0.10.0 and 0.10.1 return a stale IV to callers, which can weaken confidentiality of TPM-protected data in virtualized and containerized workloads.

Affected Products

libtpms version 0.10.0
libtpms version 0.10.1
Applications integrating libtpms with OpenSSL 3.x

Discovery Timeline

2026-01-02 - CVE-2026-21444 published to NVD
2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-21444

Vulnerability Analysis

The vulnerability stems from incorrect IV handling in the libtpms OpenSSL 3.x backend. When a symmetric cipher operation completes, callers expect to receive the final IV produced by the cipher. The libtpms integration instead returns the initial IV that was supplied before the operation began.

This breaks chaining-mode contracts for ciphers such as CBC and CFB. Subsequent calls that reuse the returned IV operate as if no state advancement occurred, which can cause IV reuse across successive blocks of data. IV reuse degrades the confidentiality guarantees of the cipher and may allow recovery of plaintext relationships across encrypted blocks.

The defect is local in scope and requires low-privileged access to invoke the affected TPM emulation interfaces. It does not directly enable code execution or modification of data, but the resulting weakened ciphertext can expose sensitive material handled by the emulated TPM.

Root Cause

The root cause is an incorrect return path in the symmetric cipher wrapper between libtpms and OpenSSL 3.x. The wrapper failed to update the IV buffer with the cipher's output state after the operation. The upstream fix is committed in stefanberger/libtpms commit 33c9ff07 and described in GHSA-7jxr-4j3g-p34f.

Attack Vector

Exploitation requires local access with privileges sufficient to invoke libtpms cipher interfaces, typically through a virtual machine, container, or local process consuming TPM emulation. An attacker observing weakened ciphertext output, or capable of forcing repeated encryptions, may recover plaintext relationships or sensitive key-protected material. The flaw does not affect integrity or availability.

// No verified exploit code is publicly available for CVE-2026-21444.
// See the upstream advisory and commit for the technical fix:
//   https://github.com/stefanberger/libtpms/security/advisories/GHSA-7jxr-4j3g-p34f
//   https://github.com/stefanberger/libtpms/commit/33c9ff074cb16c1841ce7d7f33643c17c426743a

Detection Methods for CVE-2026-21444

Indicators of Compromise

Presence of libtpms shared libraries at version 0.10.0 or 0.10.1 on hosts running TPM emulation (for example, swtpm or QEMU-based virtualization).
Cryptographic outputs from emulated TPM operations exhibiting repeating ciphertext blocks indicative of IV reuse.
Package manager entries showing libtpms-0.10.0 or libtpms-0.10.1 without the 0.10.2 security update applied.

Detection Strategies

Inventory virtualization hosts and containers for installed libtpms versions using rpm -q libtpms, dpkg -l libtpms, or equivalent package queries.
Audit dependent packages such as swtpm that link against libtpms to confirm the underlying library version.
Review software bill of materials (SBOM) artifacts for components matching libtpms_project:libtpms at vulnerable versions.

Monitoring Recommendations

Log and monitor invocations of TPM emulation interfaces on multi-tenant hosts to identify unusual cipher operation patterns.
Track package update events on hypervisors to confirm propagation of the 0.10.2 patch.
Alert on processes invoking libtpms from unexpected user contexts on shared infrastructure.

How to Mitigate CVE-2026-21444

Immediate Actions Required

Upgrade libtpms to version 0.10.2 or later on every host providing TPM emulation services.
Rebuild or update downstream consumers such as swtpm and QEMU integrations after replacing the library.
Rotate any cryptographic material that was generated or wrapped by an emulated TPM using a vulnerable libtpms build, where feasible.

Patch Information

The fix is delivered in libtpms 0.10.2. The corrective change is published in stefanberger/libtpms commit 33c9ff07 and detailed in the GHSA-7jxr-4j3g-p34f security advisory. Distribution-specific updates should be applied through the operating system vendor's security channel as they become available. Additional discussion is available in GitHub issue #541.

Workarounds

No workarounds are available according to the upstream advisory; upgrading to 0.10.2 is the required remediation.
Where immediate patching is not possible, restrict access to TPM emulation interfaces to trusted local users and minimize the volume of sensitive data processed through the emulated TPM until the fix is applied.

bash

# Verify installed libtpms version and upgrade on Debian/Ubuntu
dpkg -l | grep libtpms
sudo apt-get update && sudo apt-get install --only-upgrade libtpms0

# Verify installed libtpms version and upgrade on RHEL/Fedora
rpm -q libtpms
sudo dnf upgrade libtpms

# Confirm the patched version (0.10.2 or later) is active
ldconfig -p | grep libtpms