{"id":"CVE-2026-121876","kind":"vulnerability","aliases":["CVE-2026-121876"],"related":[],"title":"systemd GPT auto-generator lets a malicious host inject partitions into confidential guests","description":"A flaw was found in the interaction between systemd-gpt-auto-generator and \nconfidential computing guest VM images in OpenShift Sandboxed Containers \n(confidential peer pods). systemd-gpt-auto-generator automatically discovers \nand mounts GPT partitions by type GUID at boot with no user confirmation. In \nthe confidential computing threat model, where the host/hypervisor is the \nadversary, a malicious host can inject partitions into the guest's virtual \ndisk. Most critically, injecting a swap partition causes the guest kernel to \npage out TEE-encrypted memory to a host-controlled block device, breaking the \nconfidentiality guarantee of the hardware TEE (AMD SEV-SNP, Intel TDX).\n\nThe PodVM images use a GPT-partitioned disk with dm-verity on the root \npartition. However, the roothash= kernel parameter only disables root \nauto-discovery — non-root partitions (swap, /home, /var, /srv, /var/tmp) are \nstill auto-discovered and mounted. The generator is shipped unmasked in the \nRHEL systemd-udev subpackage, and no kernel command line parameter in the \nmeasured UKI addon disables it. Additionally, the PodVM measurement script \ncaptures PCRs 3, 9, 11, and 12, but not PCR 5 (GPT partition table), so \npartition table modifications are not detected by remote attestation.","summary":"In OpenShift Sandboxed Containers confidential peer pod VM images, systemd-gpt-auto-generator automatically mounts GPT partitions at boot without confirmation. A malicious host can inject a swap partition, causing the guest kernel to page out TEE-encrypted memory to host-controlled storage and breaking confidentiality.","severity":"high","cvss":7.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OpenShift sandboxed containers (confidential peer pods PodVM image)","fixed":[],"affected":"unknown, Red Hat lists no versions","ecosystem":"vendor"}],"ecosystems":[],"tags":["confidential-computing","infrastructure","openshift","openshift-sandboxed-containers","rhel","systemd"],"not_affected_if":["no-confidential-peer-pods"],"how_to_check":"- Applies only if you run OpenShift Sandboxed Containers confidential peer pods (AMD SEV-SNP or Intel TDX).\n- Check whether the measured kernel command line (UKI addon) of your PodVM image contains systemd.gpt_auto=0. Red Hat says no parameter in the shipped addon disables the generator.\n- Check whether /etc/systemd/system-generators/systemd-gpt-auto-generator in the image is a symlink to /dev/null (masked).\n- Check whether your PodVM measurement script includes PCR 5 (GPT partition table). Red Hat says it captures PCRs 3, 9, 11 and 12 only.\n- Red Hat lists no affected or fixed versions yet: watch the CVE page and Bugzilla 2558210 for errata.","fix":null,"status":"open","published_at":"2026-11-12T17:17:29+00:00","first_seen_at":"2026-11-12T17:39:37+00:00","triaged_at":"2026-11-12T17:39:49+00:00","updated_at":"2026-11-12T17:42:08+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-12T17:39:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"systemd GPT auto-generator lets a malicious host inject partitions into confidential guests","impact":"high","summary":"In OpenShift Sandboxed Containers confidential peer pod VM images, systemd-gpt-auto-generator automatically mounts GPT partitions at boot without confirmation. A malicious host can inject a swap partition, causing the guest kernel to page out TEE-encrypted memory to host-controlled storage and breaking confidentiality.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["openshift","openshift-sandboxed-containers","confidential-computing","systemd","rhel"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Host reads confidential guest memory via injected swap partition","analyst_note":"Find the Red Hat advisory or errata for OpenShift Sandboxed Containers to confirm affected and fixed versions and any mitigation for the generator.","how_to_check":"- Check whether the PodVM image uses a GPT disk with non-root partitions such as swap, /home, /var or /srv, and whether the systemd-udev package ships the generator unmasked.\n- Check whether PCR 5 is included in the measurement script; the sources say PCRs 3, 9, 11 and 12 are captured but not PCR 5.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-confidential-peer-pods"],"who_is_affected":"Teams running OpenShift Sandboxed Containers with confidential peer pods on AMD SEV-SNP or Intel TDX hardware. The sources say the roothash kernel parameter only covers the root partition, and the generator is unmasked in the RHEL systemd-udev subpackage, so non-root partitions are still auto-mounted. Clusters without confidential peer pods are not described as affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000838,"input_tokens":4933,"output_tokens":689,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Red Hat advisory or errata for OpenShift Sandboxed Containers to confirm affected and fixed versions and any mitigation for the generator.","search":"'-121876':17A,20A '-2026':16A,19A '/home':230C '/srv':232C '/var':231C '/var/tmp':233C '11':275C '12':277C '3':273C '5':281C '9':274C 'addit':266C 'addon':263C 'adversari':146C 'amd':191C 'attest':294C 'auto':4A,52B,100C,118C,223C,237C 'auto-discov':236C 'auto-discoveri':222C 'auto-gener':3A 'automat':54B,120C 'block':181C 'boot':59B,130C 'break':87B,183C 'captur':271C 'caus':70B,165C 'command':256C 'comput':31B,104C,138C 'confidenti':13A,30B,44B,88B,103C,112C,137C,185C 'confidential':24A 'confidential-comput':29B 'confirm':61B,134C 'contain':37B,43B,111C 'containers':23A 'control':84B,180C 'critic':160C 'cve':15A,18A 'detect':291C 'devic':182C 'disabl':220C,264C 'discov':121C,238C 'discoveri':224C 'disk':158C,205C 'dm':208C 'dm-veriti':207C 'encrypt':79B,174C 'flaw':90C 'found':92C 'generat':5A,53B,101C,119C,242C 'gpt':2A,51B,56B,99C,117C,124C,203C,282C 'gpt-partit':202C 'guarante':186C 'guest':14A,72B,105C,155C,167C 'guid':128C 'hardwar':189C 'host':9A,64B,83B,149C,179C 'host-control':82B,178C 'host/hypervisor':143C 'howev':214C 'imag':48B,107C,199C 'image':28A 'infrastructur':32B 'inject':10A,66B,151C,161C 'intel':195C 'interact':95C 'kernel':73B,168C,217C,255C 'let':6A 'line':257C 'malici':8A,63B,148C 'measur':261C,269C 'memori':80B,175C 'model':140C 'modif':288C 'mount':55B,123C,240C 'non':226C 'non-root':225C 'openshift':21A,33B,35B,41B,109C 'openshift-sandboxed-contain':34B 'page':75B,170C 'paramet':218C,258C 'partit':11A,57B,69B,125C,152C,164C,204C,213C,228C,283C,286C 'pcr':280C 'pcrs':272C 'peer':25A,45B,113C 'pod':46B,114C 'pods':26A 'podvm':27A,198C,268C 'remot':293C 'rhel':38B,248C 'root':212C,221C,227C 'roothash':216C 'sandbox':36B,42B,110C 'sandboxed':22A 'script':270C 'sev':193C 'sev-snp':192C 'ship':244C 'snp':194C 'still':235C 'storag':85B 'subpackag':252C 'swap':68B,163C,229C 'systemd':1A,39B,50B,98C,116C,250C 'systemd-gpt-auto-gener':49B,97C,115C 'systemd-udev':249C 'tabl':284C,287C 'tdx':196C 'tee':78B,173C,190C 'tee-encrypt':77B,172C 'threat':139C 'type':127C 'udev':251C 'uki':262C 'unmask':245C 'use':200C 'user':133C 'veriti':209C 'virtual':157C 'vm':47B,106C 'without':60B","nicknames":[],"mitigations":[],"who_affected":"Teams running OpenShift Sandboxed Containers with confidential peer pods on AMD SEV-SNP or Intel TDX hardware. The sources say the roothash kernel parameter only covers the root partition, and the generator is unmasked in the RHEL systemd-udev subpackage, so non-root partitions are still auto-mounted. Clusters without confidential peer pods are not described as affected.","tier":"B","verified":{"mitigations":{"at":"2026-11-12T17:42:08Z","by":"analyst","doc":"https://access.redhat.com/security/cve/CVE-2026-121876","run_id":3759},"workarounds":{"at":"2026-11-12T17:42:08Z","by":"analyst","doc":"https://access.redhat.com/security/cve/CVE-2026-121876","run_id":3759},"how_to_check":{"at":"2026-11-12T17:42:08Z","by":"analyst","doc":"https://access.redhat.com/security/cve/CVE-2026-121876","run_id":3759}},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["openshiftsandboxedcontainersconfidentialpeerpodspodvmimage","sandboxedcontainersconfidentialpeerpodspodvmimage"],"ptokens":["confidential","containers","image","openshift","peer","pods","podvm","sandboxed"],"labels":["confidentialcomputing","high","infrastructure","openshift","openshiftsandboxedcontainers","rhel","systemd"],"campaign_type":null,"search_a":"'-121876':17A,20A '-2026':16A,19A 'auto':4A 'auto-gener':3A 'confidenti':13A 'confidential':24A 'containers':23A 'cve':15A,18A 'generat':5A 'gpt':2A 'guest':14A 'host':9A 'image':28A 'inject':10A 'let':6A 'malici':8A 'openshift':21A 'partit':11A 'peer':25A 'pods':26A 'podvm':27A 'sandboxed':22A 'systemd':1A","search_b":"'auto':52B 'automat':54B 'boot':59B 'break':87B 'caus':70B 'comput':31B 'confidenti':30B,44B,88B 'confidential-comput':29B 'confirm':61B 'contain':37B,43B 'control':84B 'encrypt':79B 'generat':53B 'gpt':51B,56B 'guest':72B 'host':64B,83B 'host-control':82B 'imag':48B 'infrastructur':32B 'inject':66B 'kernel':73B 'malici':63B 'memori':80B 'mount':55B 'openshift':33B,35B,41B 'openshift-sandboxed-contain':34B 'page':75B 'partit':57B,69B 'peer':45B 'pod':46B 'rhel':38B 'sandbox':36B,42B 'storag':85B 'swap':68B 'systemd':39B,50B 'systemd-gpt-auto-gener':49B 'tee':78B 'tee-encrypt':77B 'vm':47B 'without':60B","search_c":"'/home':230C '/srv':232C '/var':231C '/var/tmp':233C '11':275C '12':277C '3':273C '5':281C '9':274C 'addit':266C 'addon':263C 'adversari':146C 'amd':191C 'attest':294C 'auto':100C,118C,223C,237C 'auto-discov':236C 'auto-discoveri':222C 'automat':120C 'block':181C 'boot':130C 'break':183C 'captur':271C 'caus':165C 'command':256C 'comput':104C,138C 'confidenti':103C,112C,137C,185C 'confirm':134C 'contain':111C 'control':180C 'critic':160C 'detect':291C 'devic':182C 'disabl':220C,264C 'discov':121C,238C 'discoveri':224C 'disk':158C,205C 'dm':208C 'dm-veriti':207C 'encrypt':174C 'flaw':90C 'found':92C 'generat':101C,119C,242C 'gpt':99C,117C,124C,203C,282C 'gpt-partit':202C 'guarante':186C 'guest':105C,155C,167C 'guid':128C 'hardwar':189C 'host':149C,179C 'host-control':178C 'host/hypervisor':143C 'howev':214C 'imag':107C,199C 'inject':151C,161C 'intel':195C 'interact':95C 'kernel':168C,217C,255C 'line':257C 'malici':148C 'measur':261C,269C 'memori':175C 'model':140C 'modif':288C 'mount':123C,240C 'non':226C 'non-root':225C 'openshift':109C 'page':170C 'paramet':218C,258C 'partit':125C,152C,164C,204C,213C,228C,283C,286C 'pcr':280C 'pcrs':272C 'peer':113C 'pod':114C 'podvm':198C,268C 'remot':293C 'rhel':248C 'root':212C,221C,227C 'roothash':216C 'sandbox':110C 'script':270C 'sev':193C 'sev-snp':192C 'ship':244C 'snp':194C 'still':235C 'subpackag':252C 'swap':163C,229C 'systemd':98C,116C,250C 'systemd-gpt-auto-gener':97C,115C 'systemd-udev':249C 'tabl':284C,287C 'tdx':196C 'tee':173C,190C 'tee-encrypt':172C 'threat':139C 'type':127C 'udev':251C 'uki':262C 'unmask':245C 'use':200C 'user':133C 'veriti':209C 'virtual':157C 'vm':106C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T17:17:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121876","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121876","severity":null,"published_at":"2026-11-12T17:17:29+00:00","modified_at":"2026-11-12T17:17:29+00:00","first_seen_at":"2026-11-12T17:39:37+00:00","fetched_at":"2026-11-12T17:39:37+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121876:3759","url":"https://access.redhat.com/security/cve/CVE-2026-121876","severity":null,"published_at":"2026-11-12T17:42:08+00:00","modified_at":"2026-11-12T17:42:08+00:00","first_seen_at":"2026-11-12T17:42:08+00:00","fetched_at":"2026-11-12T17:42:08+00:00","note":"Red Hat CVE page (CNA) read: confirms description, gives mitigations (systemd.gpt_auto=0 in the measured UKI addon, systemd.swap=0, mask the generator, add PCR 5 to measurement, image policy on systemd 254+). It lists no affected or fixed versions or errata yet; fix stays unknown. Reported by Spyros Seimenis (Edgeless Systems); Bugzilla 2558210. Not exploited, no PoC seen.","cites":["https://access.redhat.com/security/cve/CVE-2026-121876"]}],"documents":[{"id":137015,"url":"https://access.redhat.com/security/cve/CVE-2026-121876","title":"CVE-2026-121876 - Red Hat Customer Portal","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}