CVE-2026-20765 is a medium severity vulnerability in the tdx-guest component where the function invalidate_l2_cached_ept incorrectly validates a bitmap input. This causes valid bitmaps selecting L2 VMs for cached EPT invalidation to be rejected, while bitmaps with reserved bits set are incorrectly accepted. The flaw is an incorrect comparison logic leading to potential escalation of privilege. It was fixed in version 0.3.1.