CVE-2026-75900: SWTPM Buffer Overflow Vulnerability

CVE-2026-75900 Overview

CVE-2026-75900 is an out-of-bounds read vulnerability in the SWTPM_NVRAM_CheckHeader() function of swtpm, a software TPM (Trusted Platform Module) emulator commonly used with virtualization platforms such as QEMU/KVM and libvirt. The entry guard incorrectly validates the buffer length against sizeof(bh), where bh is a pointer, rather than sizeof(*bh), the actual size of the header struct. An undersized buffer passes validation and triggers a 2-byte heap over-read on 64-bit systems (6 bytes on 32-bit) when the totlen field is accessed. The read leaks adjacent heap memory into log output and can terminate the swtpm daemon on some platforms.

Critical Impact
A local, authenticated attacker can crash the swtpm daemon, disrupting TPM-backed virtual machines, and force small amounts of heap memory to be leaked into log files.

Affected Products

swtpm (software TPM emulator)
Red Hat products shipping swtpm (see Red Hat advisory for specific package versions)
Virtualization stacks that rely on swtpm for guest vTPM support

Discovery Timeline

2026-08-19 - CVE-2026-75900 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-75900

Vulnerability Analysis

The defect resides in swtpm's NVRAM header validation routine, SWTPM_NVRAM_CheckHeader(). This function is intended to confirm that an input buffer is at least as large as the on-disk header structure before dereferencing its fields. The check compares the buffer length to sizeof(bh) instead of sizeof(*bh). Because bh is a pointer, sizeof(bh) evaluates to the pointer width of the platform: 8 bytes on 64-bit systems and 4 bytes on 32-bit systems. The actual header struct is larger, so the guard permits buffers that are too small to hold a full header.

Once validation passes, the function reads the totlen field of the header. That access reaches beyond the allocated buffer by 2 bytes on 64-bit systems or 6 bytes on 32-bit systems. The read produces two observable effects: adjacent heap data is written into log output, and on some platforms the process aborts, terminating the swtpm daemon and disconnecting any guest TPM sessions it services.

Root Cause

The root cause is a sizeof operator misuse classified as [CWE-125] Out-of-Bounds Read. The developer applied sizeof to the pointer variable rather than the pointed-to struct. This is a common C idiom mistake that produces a silently incorrect size at compile time, defeating the guard's intent.

Attack Vector

Exploitation requires local access with low privileges on the host running swtpm. An attacker with the ability to supply or influence NVRAM state data processed by SWTPM_NVRAM_CheckHeader() can submit an undersized buffer to trigger the over-read. The primary impact is availability: the swtpm daemon may terminate, breaking vTPM functionality for hosted virtual machines. Confidentiality impact is limited to the 2 or 6 bytes of adjacent heap memory leaked into the log stream.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Red Hat CVE-2026-75900 Advisory and Red Hat Bug #2517910 for upstream technical details.

Detection Methods for CVE-2026-75900

Indicators of Compromise

Unexpected termination or repeated restarts of the swtpm daemon process on virtualization hosts.
Log entries from swtpm containing non-printable or unexpected byte sequences near NVRAM header handling messages, indicating leaked heap data.
Guest virtual machines losing vTPM connectivity or reporting TPM communication errors.

Detection Strategies

Monitor process exit codes and crash signals (SIGSEGV, SIGABRT) for the swtpm binary across virtualization hosts.
Compare installed swtpm package versions against the fixed versions listed in vendor advisories.
Audit access to swtpm NVRAM state files for modifications by local low-privilege accounts.

Monitoring Recommendations

Forward swtpm and libvirt logs to a centralized logging platform and alert on abnormal swtpm termination events.
Track systemd or supervisor restart counters for swtpm service units.
Correlate swtpm crashes with guest VM state changes to identify potential local exploitation attempts.

How to Mitigate CVE-2026-75900

Immediate Actions Required

Inventory all hosts running swtpm, including those managed by libvirt, QEMU, or Kubernetes virtualization operators.
Apply the swtpm package update from your distribution once available, prioritizing hosts that expose swtpm to multi-tenant or untrusted local users.
Restrict local shell access on virtualization hosts to trusted administrators only.

Patch Information

Consult the Red Hat CVE-2026-75900 Advisory for fixed package versions and errata. The upstream fix replaces sizeof(bh) with sizeof(*bh) in SWTPM_NVRAM_CheckHeader() so the guard compares against the actual header struct size. Distribution maintainers are expected to backport this change to supported swtpm releases.

Workarounds

Limit which local users can interact with swtpm sockets and NVRAM state directories via strict filesystem permissions.
Run swtpm under a dedicated unprivileged service account isolated from tenant workloads.
Enable automatic restart of the swtpm service unit to minimize availability impact until patches are deployed.

bash

# Configuration example: restrict swtpm state directory access
chown -R tss:tss /var/lib/swtpm-localca /var/lib/libvirt/swtpm
chmod 700 /var/lib/libvirt/swtpm

# Ensure swtpm auto-restarts on crash (systemd drop-in)
mkdir -p /etc/systemd/system/swtpm.service.d
cat > /etc/systemd/system/swtpm.service.d/restart.conf <<EOF
[Service]
Restart=on-failure
RestartSec=2s
EOF
systemctl daemon-reload