CVE-2026-85769: libtpms TPM 2.0 Emulation DoS Vulnerability

CVE-2026-85769 Overview

CVE-2026-85769 is an out-of-bounds read vulnerability in libtpms, a library that provides software Trusted Platform Module (TPM) 2.0 emulation. The flaw occurs when restoring TPM 2.0 state, such as during virtual machine power-on or migration. A malformed state blob can supply an oversized skip-block length that bypasses bounds checks through an unsafe signed-to-unsigned conversion. Successful exploitation crashes the hosting process (for example, swtpm), causing denial of service for the emulated TPM device and the dependent virtual machine.

Critical Impact
An attacker able to supply a crafted TPM state blob can crash the emulated TPM process, disrupting availability of any virtual machine relying on it.

Affected Products

libtpms (software TPM 2.0 emulation library)
swtpm (software TPM emulator that links against libtpms)
Virtualization stacks consuming libtpms for vTPM state restore or migration

Discovery Timeline

2026-09-04 - CVE CVE-2026-85769 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85769

Vulnerability Analysis

The vulnerability lives in the TPM 2.0 state unmarshaling routines in src/tpm2/Unmarshal.c. When parsing a serialized state blob, the code tracks the remaining buffer size using a signed INT32 counter. A malformed blob can encode a skip-block length larger than the remaining input. Subtracting that oversized length drives the counter negative. The subsequent bounds check casts the signed value to UINT32, producing a very large positive number that appears to satisfy the size requirement. The parser then reads past the end of the heap buffer holding the state data, referenced as [CWE-125] Out-of-Bounds Read.

Root Cause

The root cause is an unsafe signed-to-unsigned integer conversion in the unmarshal helpers. Functions such as UINT8_Unmarshal compared (UINT32)*size against the required element size without first verifying that *size was non-negative. Any code path that decremented *size below zero would silently bypass the length validation.

Attack Vector

An adjacent-network attacker capable of supplying or influencing a TPM state blob, such as during vTPM migration or state restore, can trigger the read. The impact is confined to availability. Red Hat's analysis did not confirm data corruption or information disclosure. The hosting process (typically swtpm) terminates, and the dependent virtual machine loses its emulated TPM device.

// Patch to src/tpm2/Unmarshal.c: reject negative sizes before the unsigned cast
 TPM_RC
 UINT8_Unmarshal(UINT8 *target, BYTE **buffer, INT32 *size)
 {
-    if ((UINT32)*size < sizeof(UINT8)) {
+    if (*size < 0 || (UINT32)*size < sizeof(UINT8)) {
 	return TPM_RC_INSUFFICIENT;
     }
     *target = (*buffer)[0];

Source: GitHub Commit b1462888 for libtpms

Detection Methods for CVE-2026-85769

Indicators of Compromise

Unexpected swtpm process crashes or segmentation faults recorded in host logs, particularly around VM start, resume, or live migration events.
Virtual machines losing access to their vTPM device followed by boot or attestation failures.
Core dumps from swtpm or other libtpms-linked processes referencing unmarshal functions in src/tpm2/Unmarshal.c.

Detection Strategies

Monitor hypervisor and libvirt logs for swtpm termination messages correlated with TPM state restore operations.
Inspect installed package versions of libtpms and swtpm across virtualization hosts and compare against fixed builds published by distribution vendors.
Enable core dump collection on virtualization hosts to capture crash artifacts for triage against this CVE.

Monitoring Recommendations

Alert on repeated swtpm restarts on a single host, which may indicate crafted state blobs being replayed.
Track VM migration and snapshot restore failures that coincide with TPM device errors reported by the guest.
Forward host process crash telemetry to a central data lake for correlation with virtualization control-plane events.

How to Mitigate CVE-2026-85769

Immediate Actions Required

Update libtpms and swtpm to a version containing the fix from commit b1462888180d896af03cae0487e8d45009cc445e as delivered by your distribution.
Restrict which principals can initiate vTPM migration or state restore to trusted management components only.
Restart running swtpm instances after upgrading so they load the patched library.

Patch Information

The upstream fix adds a *size < 0 guard before the unsigned cast in each unmarshal helper. It is tracked in GitHub Issue #614 for libtpms and merged via GitHub Pull Request #613 for libtpms. Distribution status is available in the Red Hat CVE-2026-85769 Advisory and Red Hat Bug Report #2528538.

Workarounds

Limit vTPM migration paths to trusted hosts and authenticated management channels until patched packages are deployed.
Disable vTPM on guests that do not require it to reduce exposure of the unmarshal code path.
Isolate virtualization management networks so untrusted adjacent hosts cannot deliver crafted state blobs.

bash

# Verify installed versions on Red Hat-based hosts and restart swtpm after patching
rpm -q libtpms swtpm
sudo dnf update libtpms swtpm
sudo systemctl restart swtpm.service || true