Intel TDX MigTD CVE-2026-61467

Exploitation requires a local, high-privileged 'system software adversary' (PR:H, AV:L) - effectively a malicious or compromised hypervisor/Ring 0 component - that can reach and interact with the MigTD virtio driver on a host using Intel TDX with the Migration Trust Domain for TD migration. The flaw is a use-after-free (CWE-416) with low attack complexity and no user interaction and no special attack requirements (AT:N), but it is fundamentally gated by needing hypervisor-level privilege and local access. Limiting factors: it is not remotely or unauthenticated-exploitable, it only affects deployments that run Intel TDX MigTD (a specialized confidential-computing migration component), and impact is bounded to integrity (high) and availability (low) of the vulnerable system with no confidentiality impact and no subsequent-system impact. The precise trigger mechanism is not described in the available sources.

This is a moderate-severity (CVSS 4.0 base 6.8), privilege-escalation/data-corruption flaw that is a deliberate 'patch this cycle' item rather than an emergency. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N, VI:H/VA:L) describes a locally exploitable use-after-free that a high-privileged actor can trigger with low complexity, yielding high integrity impact and low availability impact but no confidentiality impact. The description frames the attacker as a 'system software adversary with a privileged user' operating at Ring 0 (hypervisor), which is consistent with PR:H and AV:L - this is not a remote or unauthenticated issue. No EPSS score, no CISA KEV listing, and no PoC reference are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_month,' which aligns with the signal picture: real but bounded risk, gated behind local access and high privilege. The key tension is that the required attacker (a privileged hypervisor-level adversary) is also the trust boundary MigTD is designed to defend against in confidential computing - so within the TDX threat model the integrity impact is meaningful even though the raw access prerequisites look high. No conflicting signals were found; the main gap is that the precise trigger mechanism is not described in the available sources.

A privileged host/hypervisor-level actor with local access to a system running Intel TDX MigTD interacts with the MigTD virtio driver to trigger a use-after-free, corrupting driver memory to undermine the integrity of the Migration Trust Domain. Because MigTD is meant to protect migration against exactly this kind of malicious system software, successful exploitation could enable escalation of privilege or data corruption within the migration trust boundary. No public exploit code or PoC reference is provided in the input.