CVE-2026-20765

Incorrect comparison for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Incorrect comparison for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Incorrect comparison for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Incorrect comparison for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

tdx_guest::tdcall::invalidate_l2_cached_ept() takes a bitmap that selects the L2 VMs whose cached EPT translations should be invalidated. Bits 1 through 3 select L2 VMs 1 through 3, and all other bits are reserved. The input check was inverted:

if l2_vm_idx_bitmap & !0b1110 == 0 {
    return Err(TdCallError::TdxOperandInvalid);
}

l2_vm_idx_bitmap & !0b1110 isolates the bits that are not allowed. A result of zero means the bitmap is valid, and the function returned an error in that case. Every valid bitmap, such as 0b0010 or 0b1110, was therefore rejected with TdxOperandInvalid. Bitmaps with reserved bits set, such as 0b0001 or 0b1_0000, were forwarded to the TDX module.

Intel describes the issue as an incorrect comparison and classifies it as escalation of privilege, with a CVSS 4.0 base score of 4.6, in INTEL-SA-01462.

The flaw was corrected in commit 311d33b, released in 0.3.1. The function now rejects an empty bitmap and any bit outside 0b1110.

Reported by Borys Tsyrulnikov.