This vulnerability arises from the use of a predictable, hardcoded challenge nonce in the Keylime verifier's TPM quote attestation process within Red Hat Enterprise Linux 10. An attacker who has root privileges on an enrolled monitored machine can collect valid TPM quotes and replay them later to bypass detection mechanisms. The flaw is specific to the push model deployment of Keylime. The CVSS 3.1 vector indicates local attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity with low impact on availability. Red Hat has published an advisory but has not yet provided a patch or official remediation instructions.

The vulnerability allows an attacker with root access on a monitored system to evade detection by replaying valid TPM quotes due to the use of a predictable nonce. This compromises the integrity and confidentiality of the attestation process, potentially allowing persistent undetected system compromise. Availability impact is low. The issue is limited to the push model deployment of Keylime and requires high privileges to exploit.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-6420 for current remediation guidance. Until a fix is available, restrict root access on monitored machines and consider alternative attestation methods or deployment models if feasible. Monitor Red Hat communications for updates on official fixes.