libtpms CVE-2026-85769

Exploitation requires the ability to supply a malformed TPM state blob to the libtpms state-restore code path. This is triggered specifically during VM power-on from a saved state, snapshot restore, or live migration - not during normal runtime TPM operations. The attacker must be adjacent-network to the hypervisor (AV:A): in practice this means access to the management or migration network, or the ability to inject a crafted snapshot file onto the hypervisor's storage. No authentication to libtpms itself is required (PR:N), but reaching the vulnerable path requires positional access on the infrastructure side. Exploitation is limited to denial of service (swtpm crash, VM TPM loss); no code execution path or data leakage has been confirmed.

The CVSS vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (score 6.5) is well-calibrated. The adjacent-network attack vector is the critical limiting factor: the attacker must be in a position to supply a crafted TPM state blob, which in practice means access to the VM migration channel, the hypervisor management plane, or the ability to provide a malicious snapshot file - not a trivially reachable network position. The low attack complexity and no-privilege requirement mean the technique itself is straightforward once the attacker has that positional access. Availability impact is high (swtpm process crash brings down virtual TPM for the VM), but confidentiality and integrity are explicitly confirmed unaffected by the vendor. No CISA KEV listing and no public exploit identified at time of analysis; EPSS data was not provided. Real-world priority is moderate for hypervisor operators running KVM with virtual TPM enabled: the impact is VM disruption rather than host compromise or data exfiltration. For environments without live migration or VM snapshotting exposed to untrusted parties, exploitability is further constrained.

An attacker with access to the live-migration or snapshot-restore channel of a KVM/QEMU hypervisor crafts a TPM state blob with an oversized skip-block length field. When a target VM is powered on or migrated, libtpms parses the blob, the size counter wraps negative, and the swtpm process crashes, causing the VM to lose its TPM device and potentially halt. No public proof-of-concept has been identified, but the fix commit makes the bug straightforward to reconstruct for a researcher with access to a KVM+swtpm environment.