CVE-2026-6420 is a vulnerability in Keylime, a TPM-based remote boot attestation and runtime integrity measurement solution. The flaw involves the use of a hardcoded challenge nonce during TPM quote attestation, which can be exploited to bypass security controls. The issue is fixed by updating Keylime to version 7.14.2. This vulnerability affects Keylime packages in Red Hat Enterprise Linux 10 and its extended update support versions. The vendor advisory from Red Hat confirms the moderate severity and provides updated packages to remediate the issue.

The vulnerability allows an attacker to bypass security mechanisms in the TPM quote attestation process due to the reuse of a hardcoded challenge nonce. This could undermine the integrity verification of remote systems relying on Keylime for attestation, potentially allowing unauthorized access or trust to be established incorrectly. The impact is considered moderate based on the vendor advisory.

A patch is available and should be applied by upgrading Keylime to version 7.14.2 or later as provided by the vendor. Red Hat has released updated packages for Red Hat Enterprise Linux 10 and related platforms to address this issue. Users should follow the vendor's official update instructions to remediate the vulnerability.