2026-09-29
CVE-2026-89751: one extra bit in Linux TDX
A port-I/O mask error, live TDX testing, and the Linux review that followed. The bug I reported in March now has a CVE.
Writing
2026-08-17
Two bugs in Intel's TDX guest crate
One TDCALL wrapper discarded a correctly packed RCX value. Another inverted a bitmap validation check. Intel fixed both bugs in tdx-guest 0.3.1.
In the public record
Intel
I found two privilege-escalation defects in Intel TDX Guest software. Intel rated both issues 4.6 Medium and corrected them in version 0.3.1. The assessment requires a local, highly privileged attacker.
Microsoft
I found an out-of-bounds read in the Open Enclave SDK quote parser. Unguarded pointer arithmetic read an attacker-controlled SGX quote buffer. Microsoft rated the issue Low severity and corrected it in version 0.19.16.
GHSA-cpr6-5fw2-32xx
2026-07-14
Linux kernel
I found an off-by-one mask and incorrect 32-bit zero-extension in the x86/TDX code for port I/O. Both fixes are upstream with my Reported-by credit. The Linux kernel CVE team assigned CVE-2026-89751 to the mask bug.
DPDK
I wrote the fix for a double free in the vectorized receive recovery path of NVIDIA mlx5. NVIDIA reviewed and approved the fix. DPDK backported it to the 25.11 stable branch.
Other accepted reports
Fortanix
I reported missing server authentication in the salmiac KMS client. The defect let an untrusted Nitro parent get the LUKS2 passphrase. Fortanix corrected the defect in pull request 106 and gave me credit in a private advisory.
Intel
Intel accepted four additional reports for attestation software and key broker software. Intel has not published the details. I keep the details private during coordinated disclosure.
2026