Intel MigTD CVE-2026-60020

Exploitation requires a deployment of the Intel TDX Migration Trust Domain (MigTD) whose virtio-serial driver is in use (i.e., TDX confidential-VM live-migration functionality is enabled), plus local access and privileged (system-software / hypervisor Ring 0) rights on the host - the CVSS vector encodes this as AV:L and PR:H. Limiting factors that reduce realistic risk: the attacker must already possess high privileges (an external or unprivileged actor cannot trigger it), access must be local rather than network-reachable, and the affected code path is specific to the TDX migration feature rather than a default general-purpose service. Impact is bounded to low availability degradation (VA:L) with no confidentiality or integrity consequence and no subsequent-system scope change.

This is a medium-severity denial-of-service issue (CVSS 4.0 base 4.6) driven entirely by an availability impact, with no confidentiality or integrity effect (VC:N/VI:N/VA:L). The CVSS vector describes a local, low-complexity attack requiring high privileges and no user interaction (AV:L/AC:L/AT:N/PR:H/UI:N), and the description reinforces this: a 'system software adversary with a privileged user' acting 'via local access.' The PR:H requirement is the dominant mitigating factor - the attacker must already hold privileged system-software (hypervisor-level) access, which substantially narrows the realistic threat to an already-privileged or compromised host rather than an external actor. No EPSS score was provided, the CVE is not listed in CISA KEV, and no proof-of-concept or exploit reference appears in the input (the only reference is the Intel vendor advisory). There is therefore no evidence of active exploitation, and the vuln.today decision label of 'this_month' aligns with a moderate, non-emergency priority. The signals are internally consistent (local vector, privileged, availability-only, not weaponized); the one notable gap is the absence of EPSS data, so probabilistic exploitation likelihood cannot be quantified from the input.

An adversary who already holds privileged system-software access on a host running an Intel TDX Migration Trust Domain repeatedly exercises the MigTD virtio-serial driver code path, triggering a memory leak (failure to free memory after use) that gradually exhausts available memory. With no cleanup, sustained triggering degrades or halts MigTD availability, producing a denial of service. No public exploit identified at time of analysis; exploitation requires local access and high privileges per the CVSS vector.