Threats affecting pkg:cargo/tdx-guest

A vulnerability in the tdx-guest component causes the function enter_l2_vcpu to pass an incorrect RCX operand to the TDG.VP.ENTER TDCALL. This results in the TDX module receiving a VM index of 0 and misinterpreting invalidation control bits, potentially leading to escalation of privilege. The issue has a CVSS 4.0 base score of 4.6 (medium severity). It was fixed in version 0.3.1 by correcting the RCX value calculation.

CVE-2026-20765 is a medium severity vulnerability in the tdx-guest component where the function invalidate_l2_cached_ept incorrectly validates a bitmap input. This causes valid bitmaps selecting L2 VMs for cached EPT invalidation to be rejected, while bitmaps with reserved bits set are incorrectly accepted. The flaw is an incorrect comparison logic leading to potential escalation of privilege. It was fixed in version 0.3.1.