CVE-2026-85769 Red Hat CVE debrief

Who should care

Defenders of virtual machines using libtpms for TPM 2.0 emulation should assess exposure and prioritize patching or mitigating this vulnerability to prevent potential denial of service.

Why it matters

CVE-2026-85769 is a medium-severity vulnerability in libtpms that can cause denial of service in virtual machines using TPM 2.0 emulation. Defenders of these environments should assess exposure and prioritize patching or mitigation to prevent potential disruptions.

• Denial of service to emulated TPM devices and dependent virtual machines.
• Potential disruption to virtual machine operations relying on TPM 2.0 emulation.
• Need for verification of libtpms versions and exposure in virtual machine environments.
• Priority for patching or mitigating the vulnerability to prevent exploitation.

Technical summary

libtpms has a flaw in its TPM 2.0 state restoration process. A malformed state blob can cause an oversized skip-block length, leading to a negative internal size counter and bypassing bounds checks. This can result in reading memory outside the heap buffer, crashing the process hosting libtpms, such as swtpm, and causing a denial of service to the emulated TPM device and dependent virtual machines.

Defensive priority

Medium

Recommended defensive actions

• Review and apply patches from libtpms maintainers or affected vendors.
• Inventory and assess exposure of virtual machines using libtpms for TPM 2.0 emulation.
• Monitor for and restrict malicious state blob inputs to libtpms.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in libtpms. Red Hat has a reference to the issue and provides additional information. The vulnerability was addressed in a libtpms commit. The issue report for the vulnerability is also available. The CVE record was published on 2026-09-04T18:18:07.153Z and has not been modified since then. The NVD entry provides a detailed assessment of the vulnerability. The Red Hat security advisory provides additional information on the vulnerability and its impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.