{"id":"CVE-2026-75900","aliases":["ALPINE-CVE-2026-75900","AZL-96876","DEBIAN-CVE-2026-75900","EUVD-2026-62363","GHSA-gqrg-h59c-j4wj","SUSE-SU-2026:23879-1","SUSE-SU-2026:23927-1","SUSE-SU-2026:24114-1","SUSE-SU-2026:24156-1","SUSE-SU-2026:4366-1","UBUNTU-CVE-2026-75900","openSUSE-SU-2026:11598-1","openSUSE-SU-2026:22048-1"],"status":"published","title":"Swtpm: swtpm: out-of-bounds read in swtpm_nvram_checkheader due to sizeof(pointer) vs sizeof(struct) mismatch","description":"An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00111,"percentile":0.01357,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-08-19T07:44:35Z","modified":"2026-11-06T17:30:34Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"swtpm","fixed_in":["0.10.2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"swtpm","fixed_in":["0.10.2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"swtpm","fixed_in":["0.10.2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"swtpm","fixed_in":["0.10.2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"swtpm","fixed_in":["0.8.1-6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"swtpm","fixed_in":["0.10.2-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"swtpm","fixed_in":["0.8.0-2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"swtpm","fixed_in":["0.9.0-slfo.1.1_3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"swtpm","fixed_in":["0.10.2-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"swtpm","fixed_in":["0.10.2-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"swtpm","fixed_in":["0.10.2-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"swtpm","fixed_in":["0.9.0-150700.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"swtpm","fixed_in":["0.10.2-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"swtpm","fixed_in":["0.10.2-160000.1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"swtpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"swtpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"swtpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"swtpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"swtpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.1-6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"swtpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.1+ds-1","0.10.2-1","0.10.2-2","0.7.1-1.3","0.7.1-1.4","0.7.1-1.5"]},{"source":"osv","ecosystem":"Debian:13","package":"swtpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.1+ds-1","0.10.2-1","0.10.2-2","0.7.1-1.5"]},{"source":"osv","ecosystem":"Debian:14","package":"swtpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2-1"}]}],"versions":["0.10.1+ds-1","0.7.1-1.5"]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"swtpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0-2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"swtpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0-slfo.1.1_3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"swtpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"swtpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"swtpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"swtpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.0-150700.3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"swtpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.1-0ubuntu1","0.6.1-0ubuntu2","0.6.1-0ubuntu3","0.6.1-0ubuntu4","0.6.1-0ubuntu5","0.6.3-0ubuntu1","0.6.3-0ubuntu2","0.6.3-0ubuntu3","0.6.3-0ubuntu3.1","0.6.3-0ubuntu3.2","0.6.3-0ubuntu3.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"swtpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.3-0ubuntu2","0.7.3-0ubuntu3","0.7.3-0ubuntu5","0.7.3-0ubuntu5.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"swtpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.1+ds-1ubuntu3","0.10.1+ds-1ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"swtpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.3-0ubuntu8","0.7.3-0ubuntu9","0.10.1+ds-1ubuntu2","0.10.1+ds-1ubuntu3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"swtpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"swtpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.2-160000.1.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-75900","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517910","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75900","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gqrg-h59c-j4wj"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-75900","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-75900","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623879-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1275653","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75900","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623927-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624114-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1221342","tags":["report"]},{"url":"https://bugzilla.suse.com/1251789","tags":["report"]},{"url":"https://bugzilla.suse.com/1266339","tags":["report"]},{"url":"https://bugzilla.suse.com/1271417","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202624156-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264366-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-75900","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75900","tags":["report"]},{"url":"https://github.com/stefanberger/swtpm/pull/1155","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-75900","title":"Swtpm: swtpm: out-of-bounds read in swtpm_nvram_checkheader due to sizeof(pointer) vs sizeof(struct) mismatch","description":"An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.","status":"published","published":"2026-08-19T07:44:35.968Z","modified":"2026-11-06T00:43:52.168Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-06T01:55:46.939755Z"}],"euvd":[{"id":"EUVD-2026-62363","description":"An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.","status":"published","published":"2026-08-19T07:44:35Z","modified":"2026-11-06T00:43:52Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-06T02:02:53.341523Z"}],"ghsa":[{"id":"GHSA-gqrg-h59c-j4wj","title":"An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The...","description":"An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.","status":"published","published":"2026-08-19T09:31:24Z","modified":"2026-08-19T09:31:30Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:10:37.733287Z"}],"nvd":[{"id":"CVE-2026-75900","description":"An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.","status":"published","published":"2026-08-19T08:17:14.073Z","modified":"2026-11-09T20:10:00.2Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-09T22:15:51.558963Z"}],"osv":[{"id":"ALPINE-CVE-2026-75900","description":"An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.","status":"published","published":"2026-08-19T08:17:14.073Z","modified":"2026-11-03T06:33:03.907180978Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:15:37.282377Z"},{"id":"DEBIAN-CVE-2026-75900","description":"An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.","status":"published","published":"2026-08-19T08:17:14.073Z","modified":"2026-11-10T09:47:43.837070313Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-10T10:26:30.347596Z"},{"id":"UBUNTU-CVE-2026-75900","description":"An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.","status":"published","published":"2026-08-19T08:17:00Z","modified":"2026-10-17T13:01:05.908808941Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:57:13.483205Z"},{"id":"AZL-96876","title":"CVE-2026-75900 affecting package swtpm for versions less than 0.8.1-6","description":"An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.","status":"published","published":"2026-08-19T08:17:14Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"openSUSE-SU-2026:11598-1","title":"swtpm-0.10.2-1.1 on GA media","description":"These are all security issues fixed in the swtpm-0.10.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-25T00:00:00Z","modified":"2026-08-26T10:15:04.921646075Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:22048-1","title":"Security update for swtpm","description":"This update for swtpm fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2026-75900: Out-of-bounds read in SWTPM_NVRAM_CheckHeader due to sizeof(pointer) vs sizeof(struct) mismatch\n  (bsc#1275653).\n\nChanges for swtpm:\n\nUpdate to 0.10.2:\n\n* Properly check for truncation following snprintf call\n- add upstream signing key and validate source signature\n- Fix SELinux policy for virtqemud_t swtpm_t setsched\n process and unix socket interactions. Allows virtqemud_t to: Signal and\n control swtpm_t processes (noatsecure, rlimitinh, siginh, signull, setsched),\n create and listen on Unix stream sockets with swtpm_t processes (bsc#1266339).\n Already accepted on upstream:\n https://github.com/stefanberger/swtpm/pull/1132\n- Drop tunable in require to avoid policy loading issues\n with toolchain 3.11 (bsc#1271417).\n Can be dropped, once this is accepted upstream:\n https://github.com/stefanberger/swtpm/pull/1139\n- Update SELinux module dir as macro to allow root path move from /var/lib/selinux\n to /etc/selinux (bsc#1221342)\n- Also load swtpm_libvirt in the selinux subpackage (bsc#1251789)\n- Update to version 0.10.1:\n + swtpm: Fix build error on 32bit systems due to inconsistent\n _FILE_OFFSET_BITS.\n + swtpm_setup:\n - Use DISTRO_PROFILES_DIR when listing profiles (fix path\n issue).\n - Do not pass a TPM 2 profile to swtpm when reconfiguring.\n + selinux:\n - Add rule for swtpm to be able to read password from pipe.\n - allow to map state file.\n - add NFS permissions for swtpm_t.\n - Add rule to allow swtpm_t opening of virt_log_t files.\n","status":"published","published":"2026-10-07T09:32:20Z","modified":"2026-10-19T17:23:11.641516499Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23879-1","title":"Security update for swtpm","description":"This update for swtpm fixes the following issue:\n\n- CVE-2026-75900: Out-of-bounds read in SWTPM_NVRAM_CheckHeader due to sizeof(pointer) vs sizeof(struct) mismatch\n  (bsc#1275653).\n","status":"published","published":"2026-09-22T12:26:41Z","modified":"2026-09-28T18:23:14.000651774Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23927-1","title":"Security update for swtpm","description":"This update for swtpm fixes the following issue:\n\n- CVE-2026-75900: Out-of-bounds read in SWTPM_NVRAM_CheckHeader due to sizeof(pointer) vs sizeof(struct) mismatch\n  (bsc#1275653).\n","status":"published","published":"2026-09-22T11:56:50Z","modified":"2026-09-30T18:23:13.228342347Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:24114-1","title":"Security update for swtpm","description":"This update for swtpm fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2026-75900: Out-of-bounds read in SWTPM_NVRAM_CheckHeader due to sizeof(pointer) vs sizeof(struct) mismatch\n  (bsc#1275653).\n\nChanges for swtpm:\n\nUpdate to 0.10.2:\n\n* Properly check for truncation following snprintf call\n- add upstream signing key and validate source signature\n- Fix SELinux policy for virtqemud_t swtpm_t setsched\n process and unix socket interactions. Allows virtqemud_t to: Signal and\n control swtpm_t processes (noatsecure, rlimitinh, siginh, signull, setsched),\n create and listen on Unix stream sockets with swtpm_t processes (bsc#1266339).\n Already accepted on upstream:\n https://github.com/stefanberger/swtpm/pull/1132\n- Drop tunable in require to avoid policy loading issues\n with toolchain 3.11 (bsc#1271417).\n Can be dropped, once this is accepted upstream:\n https://github.com/stefanberger/swtpm/pull/1139\n- Update SELinux module dir as macro to allow root path move from /var/lib/selinux\n to /etc/selinux (bsc#1221342)\n- Also load swtpm_libvirt in the selinux subpackage (bsc#1251789)\n- Update to version 0.10.1:\n + swtpm: Fix build error on 32bit systems due to inconsistent\n _FILE_OFFSET_BITS.\n + swtpm_setup:\n - Use DISTRO_PROFILES_DIR when listing profiles (fix path\n issue).\n - Do not pass a TPM 2 profile to swtpm when reconfiguring.\n + selinux:\n - Add rule for swtpm to be able to read password from pipe.\n - allow to map state file.\n - add NFS permissions for swtpm_t.\n - Add rule to allow swtpm_t opening of virt_log_t files.\n","status":"published","published":"2026-10-07T09:30:38Z","modified":"2026-10-10T17:23:22.237967615Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:24156-1","title":"Security update for swtpm","description":"This update for swtpm fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2026-75900: Out-of-bounds read in SWTPM_NVRAM_CheckHeader due to sizeof(pointer) vs sizeof(struct) mismatch\n  (bsc#1275653).\n\nChanges for swtpm:\n\nUpdate to 0.10.2:\n\n* Properly check for truncation following snprintf call\n- add upstream signing key and validate source signature\n- Fix SELinux policy for virtqemud_t swtpm_t setsched\n process and unix socket interactions. Allows virtqemud_t to: Signal and\n control swtpm_t processes (noatsecure, rlimitinh, siginh, signull, setsched),\n create and listen on Unix stream sockets with swtpm_t processes (bsc#1266339).\n Already accepted on upstream:\n https://github.com/stefanberger/swtpm/pull/1132\n- Drop tunable in require to avoid policy loading issues\n with toolchain 3.11 (bsc#1271417).\n Can be dropped, once this is accepted upstream:\n https://github.com/stefanberger/swtpm/pull/1139\n- Update SELinux module dir as macro to allow root path move from /var/lib/selinux\n to /etc/selinux (bsc#1221342)\n- Also load swtpm_libvirt in the selinux subpackage (bsc#1251789)\n- Update to version 0.10.1:\n + swtpm: Fix build error on 32bit systems due to inconsistent\n _FILE_OFFSET_BITS.\n + swtpm_setup:\n - Use DISTRO_PROFILES_DIR when listing profiles (fix path\n issue).\n - Do not pass a TPM 2 profile to swtpm when reconfiguring.\n + selinux:\n - Add rule for swtpm to be able to read password from pipe.\n - allow to map state file.\n - add NFS permissions for swtpm_t.\n - Add rule to allow swtpm_t opening of virt_log_t files.\n","status":"published","published":"2026-10-07T09:30:38Z","modified":"2026-10-16T17:23:11.450803241Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:4366-1","title":"Security update for swtpm","description":"This update for swtpm fixes the following issue:\n\n- CVE-2026-75900: out-of-bounds read in SWTPM_NVRAM_CheckHeader due to sizeof(pointer) vs sizeof(struct) mismatch\n  (bsc#1275653).\n","status":"published","published":"2026-09-28T15:01:36Z","modified":"2026-09-29T18:23:22.263223853Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}