CVE-2026-6727: TPM RSA OAEP Information Disclosure

CVE-2026-6727 Overview

CVE-2026-6727 is a timing side-channel vulnerability in the RSA Optimal Asymmetric Encryption Padding (OAEP) decryption implementation used by Trusted Platform Module (TPM) 2.0. A privileged local attacker with access to the TPM command interface can measure timing differences during decryption to recover information about ciphertexts encrypted to TPM-managed RSA keys. Affected material includes the RSA Endorsement Key (EK), import blobs, credential blobs, and session salts. The flaw is tracked by the Trusted Computing Group as advisory TCGVRT0011 and is classified under CWE-208 (Observable Timing Discrepancy).

Critical Impact
Successful exploitation can decrypt sensitive TPM-protected blobs and, under specific conditions, allow forgery of TPM 2.0 attestations, undermining platform trust anchors.

Affected Products

TPM 2.0 implementations that perform RSA OAEP decryption using the vulnerable code paths
Systems relying on TPM-managed RSA Endorsement Keys for attestation, credential activation, and key import
Platforms whose remote attestation flows depend on the affected TPM 2.0 primitives

Discovery Timeline

2026-08-11 - CVE-2026-6727 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-6727

Vulnerability Analysis

The vulnerability resides in the RSA OAEP decryption routine exposed through the TPM command interface. The implementation processes padded plaintext in a manner whose execution time depends on secret-dependent values. An attacker who can submit chosen ciphertexts and observe response latency can distinguish valid from invalid padding structures. Over many measurements, this yields enough information to reconstruct plaintexts protected by the target RSA key.

The scope reaches core TPM cryptographic operations. Import blobs deliver key material into the TPM under protection of a parent key. Credential blobs implement TPM2_ActivateCredential, which binds credentials to specific attestation identities. Session salts seed HMAC and encryption sessions. Recovering any of these breaks the confidentiality assumptions of dependent workflows and, under specific conditions, permits forgery of TPM 2.0 quotes and attestations.

Root Cause

The root cause is a non-constant-time OAEP decoding path. The implementation branches or performs memory accesses based on padding validity and message length, producing measurable timing variance. This is a classic observable timing discrepancy [CWE-208] where secret-dependent control flow leaks through a side channel. Constant-time OAEP decoding requires that all validity checks be combined into a single arithmetic condition applied after fixed-time processing of the entire buffer.

Attack Vector

Exploitation requires local access to the TPM command interface, which typically means code execution on the host with sufficient privilege to issue TPM commands such as TPM2_RSA_Decrypt, TPM2_Import, or TPM2_ActivateCredential. The attacker submits crafted ciphertexts and records precise timing of TPM responses. Statistical analysis across many oracle queries reveals padding structure and, ultimately, plaintext bytes. The attack complexity is high because timing signals from a hardware TPM are noisy and require many samples, but the attack does not require user interaction. Refer to the Trusted Computing Group VRT0011 Advisory for the authoritative technical description.

Detection Methods for CVE-2026-6727

Indicators of Compromise

High-frequency invocation of TPM2_RSA_Decrypt, TPM2_Import, or TPM2_ActivateCredential from a single local process or user context, particularly with varied or malformed ciphertext inputs.
Sustained bursts of TPM command traffic that deviate from baseline application behavior, including repeated failures returned by the TPM to decryption commands.
Unexpected use of the Endorsement Key hierarchy by non-provisioning workloads.

Detection Strategies

Instrument the TPM software stack (tpm2-abrmd, tcsd, or vendor equivalents) to log command opcodes, callers, and return codes for correlation.
Establish per-host baselines for TPM command rates and alert on statistical anomalies, especially on decryption and credential activation opcodes.
Correlate TPM command activity with process lineage to identify unauthorized local callers issuing cryptographic operations.

Monitoring Recommendations

Forward TPM resource manager and kernel audit logs to a centralized analytics platform for long-window analysis.
Monitor attestation verification services for unexpected quote sources, replayed nonces, or attestations that fail chain validation.
Track privileged local process creation on systems that hold sensitive TPM-bound secrets and correlate with subsequent TPM interface access.

How to Mitigate CVE-2026-6727

Immediate Actions Required

Inventory systems using TPM 2.0 for attestation, disk encryption key sealing, or credential activation, and identify their TPM firmware versions and vendors.
Apply firmware updates from platform and TPM vendors as they reference TCGVRT0011; prioritize systems that expose the TPM interface to multi-tenant or lower-privilege workloads.
Restrict local access to the TPM command interface to trusted system components and administrative accounts only.

Patch Information

Remediation requires updated TPM 2.0 firmware or software implementations that perform RSA OAEP decoding in constant time. Consult the Trusted Computing Group VRT0011 Advisory and the Extended VRT0010/11 Guidance for implementer guidance, then obtain firmware from the affected TPM or platform vendor. Attestation verifiers should also be updated to enforce revocation of any Endorsement Key credentials suspected of exposure.

Workarounds

Tighten operating system access controls on the TPM device node (for example /dev/tpm0 and /dev/tpmrm0 on Linux) so that only vetted services can issue commands.
Rotate and re-provision TPM-bound keys after patching, and reissue attestation credentials to invalidate any material that may have been exposed.
For high-assurance environments, disable TPM operations that expose OAEP decryption to untrusted callers until firmware remediation is applied.

bash

# Example: restrict Linux TPM resource manager access to a dedicated group
sudo groupadd -r tss
sudo chown tss:tss /dev/tpm0 /dev/tpmrm0
sudo chmod 0660 /dev/tpm0 /dev/tpmrm0
# Audit callers of the TPM interface
sudo auditctl -w /dev/tpmrm0 -p rw -k tpm_access