swtpm CVE-2026-75900

Exploitation requires a local user account with at least low-privilege access on the affected system (PR:L per CVSS vector). The attacker must have write access to the swtpm daemon's Unix domain socket, which in typical deployments is owned by the qemu or swtpm service user - a regular unprivileged user may not have access by default depending on socket permissions. The flaw is triggered by supplying a crafted NVRAM header buffer whose length is between sizeof(bh) (8 bytes on 64-bit) and sizeof(*bh) (the full struct size), causing the guard to pass while the subsequent totlen field access reads out of bounds. The availability impact (daemon crash) is explicitly described as platform-dependent and may not materialize on all RHEL configurations. Exploitation is limited to systems where the swtpm daemon is actively running, which applies only to virtualization hosts providing virtual TPM support to QEMU/KVM guests.

The CVSS 3.1 score of 6.1 (Medium) accurately reflects the constrained attack surface: local access is required (AV:L), low-privilege credentials suffice (PR:L), and complexity is low (AC:L). The high availability impact (A:H) is tempered by the description's qualifier that daemon termination is platform-dependent and may not occur on all systems. Confidentiality impact is low (C:L) because heap data leaks to system logs rather than being returned directly to the attacker, limiting the exploitability of any leaked content. EPSS data was not included in the provided intelligence, so exploitation probability cannot be quantified. No CISA KEV listing and no public POC have been identified, which collectively suggest this is not under active widespread exploitation. The primary operational risk is in KVM/QEMU virtualization hosts: a crashed swtpm daemon disrupts virtual TPM services for guest VMs, potentially affecting VM attestation, disk encryption key unsealing (e.g., fTPM-backed LUKS), and secure boot workflows. The local-only vector substantially limits the blast radius compared to network-exploitable flaws of similar CVSS score.

A local user with a standard unprivileged account on an RHEL 8/9/10 KVM host crafts an NVRAM blob with a header buffer sized to match sizeof(bh) (8 bytes on 64-bit) - just enough to pass the flawed guard - and submits it to the swtpm daemon via its socket interface. The daemon reads 2 bytes past the allocated buffer when accessing the totlen field; on platforms where this triggers an access violation, the swtpm process terminates, disrupting TPM services for all VMs relying on it, and any heap contents at the overread address are written to the daemon's log. No public POC has been identified at time of analysis.