CVE-2026-85769: Out-of-bounds Read in Red Hat Red Hat Enterprise Linux 10

The vulnerability exists in libtpms's TPM 2.0 state deserialization code, where a malformed TPM 2.0 state blob can specify an oversized skip-block length that is not validated against the remaining input buffer size. This leads to an internal size counter becoming negative and bypassing bounds checks due to unsafe signed-to-unsigned conversion. Consequently, the parser reads memory outside the heap buffer bounds, causing a heap out-of-bounds read. Exploitation results in a denial of service by crashing the process hosting libtpms (e.g., swtpm), impacting the emulated TPM device and virtual machines relying on it. The flaw affects builds of libtpms compiled with TPM 2.0 support and is relevant in scenarios such as VM power-on or migration state restore. No information disclosure or code execution has been confirmed. Practical exposure depends on attacker ability to supply or tamper with the TPM state blob.

Successful exploitation causes a denial of service by crashing the process hosting libtpms, which disables the emulated TPM 2.0 device and the virtual machine that depends on it. There is no confirmed impact on confidentiality or integrity, and no data corruption or information disclosure has been observed.

Currently, Red Hat has not provided any mitigation that meets their standards for usability, deployment, applicability, or stability. Users should monitor Red Hat advisories for future updates or fixes. Since no official fix is available, mitigation options are limited. Practical exposure depends on whether an attacker can supply or tamper with the TPM state blob, so restricting untrusted input to TPM state restoration processes may reduce risk.