The vulnerability CVE-2025-13609 in Keylime involves the registrar component allowing identity takeover via duplicate UUID registration. An attacker can exploit this by registering a new agent with a different TPM device but using the UUID of an existing agent, overwriting the legitimate agent's identity. This flaw can lead to impersonation of the compromised agent and potentially bypass security controls. Red Hat has released patches for Keylime in Red Hat Enterprise Linux 9 and 10 to fix this issue, with updated packages available as of December 2025.

The vulnerability allows an attacker with high privileges to impersonate a legitimate Keylime agent by registering a duplicate UUID with a different TPM device. This can lead to a partial compromise of integrity (high impact on integrity), limited confidentiality loss, and low availability impact. The attacker could bypass security controls relying on agent identity, undermining the trust model of the Keylime attestation system.

Red Hat has released official security updates for Keylime in Red Hat Enterprise Linux 9 and 10 that fix this vulnerability. Users should apply these updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. The updates include fixed packages such as keylime-7.12.1-11.el9_7.3 and keylime-7.12.1-11.el10_1.3. No additional mitigation steps are indicated beyond applying the official patches.