---
id: "CVE-2026-121876"
page: "https://infrastack.ai/live/CVE-2026-121876"
kind: "vulnerability"
aliases: ["CVE-2026-121876"]
title: "systemd GPT auto-generator lets a malicious host inject partitions into confidential guests"
severity: "high"
cvss: 7.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "OpenShift sandboxed containers (confidential peer pods PodVM image)", "fixed": [], "affected": "unknown, Red Hat lists no versions", "ecosystem": "vendor"}]
ecosystems: []
tags: ["confidential-computing", "infrastructure", "openshift", "openshift-sandboxed-containers", "rhel", "systemd"]
not_affected_if: ["no-confidential-peer-pods"]
published_at: "2026-11-12T17:17:29+00:00"
first_seen_at: "2026-11-12T17:39:37+00:00"
updated_at: "2026-11-12T17:42:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121876", "first_seen_at": "2026-11-12T17:39:37+00:00"}, {"source": "analyst", "url": "https://access.redhat.com/security/cve/CVE-2026-121876", "first_seen_at": "2026-11-12T17:42:08+00:00", "cites": ["https://access.redhat.com/security/cve/CVE-2026-121876"]}]
exploit_sources: []
---

# systemd GPT auto-generator lets a malicious host inject partitions into confidential guests

Link for people: https://infrastack.ai/live/CVE-2026-121876 (this .md is for agents)

In OpenShift Sandboxed Containers confidential peer pod VM images, systemd-gpt-auto-generator automatically mounts GPT partitions at boot without confirmation. A malicious host can inject a swap partition, causing the guest kernel to page out TEE-encrypted memory to host-controlled storage and breaking confidentiality.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:OpenShift sandboxed containers (confidential peer pods PodVM image) affected unknown, Red Hat lists no versions fixed no fixed version listed

## How to check

- Applies only if you run OpenShift Sandboxed Containers confidential peer pods (AMD SEV-SNP or Intel TDX).
- Check whether the measured kernel command line (UKI addon) of your PodVM image contains systemd.gpt_auto=0. Red Hat says no parameter in the shipped addon disables the generator.
- Check whether /etc/systemd/system-generators/systemd-gpt-auto-generator in the image is a symlink to /dev/null (masked).
- Check whether your PodVM measurement script includes PCR 5 (GPT partition table). Red Hat says it captures PCRs 3, 9, 11 and 12 only.
- Red Hat lists no affected or fixed versions yet: watch the CVE page and Bugzilla 2558210 for errata.

## Timeline

- 2026-11-12T17:39:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121876
- 2026-11-12T17:42:08+00:00 analyst https://access.redhat.com/security/cve/CVE-2026-121876 — Red Hat CVE page (CNA) read: confirms description, gives mitigations (systemd.gpt_auto=0 in the measured UKI addon, systemd.swap=0, mask the generator, add PCR 5 to measurement, image policy on systemd 254+). It lists no affected or fixed versions or errata yet; fix stays unknown. Reported by Spyros Seimenis (Edgeless Systems); Bugzilla 2558210. Not exploited, no PoC seen.

## Documents

- [advisory] CVE-2026-121876 - Red Hat Customer Portal https://access.redhat.com/security/cve/CVE-2026-121876

## From the sources

A flaw was found in the interaction between systemd-gpt-auto-generator and 
confidential computing guest VM images in OpenShift Sandboxed Containers 
(confidential peer pods). systemd-gpt-auto-generator automatically discovers 
and mounts GPT partitions by type GUID at boot with no user confirmation. In 
the confidential computing threat model, where the host/hypervisor is the 
adversary, a malicious host can inject partitions into the guest's virtual 
disk. Most critically, injecting a swap partition causes the guest kernel to 
page out TEE-encrypted memory to a host-controlled block device, breaking the 
confidentiality guarantee of the hardware TEE (AMD SEV-SNP, Intel TDX).

The PodVM images use a GPT-partitioned disk with dm-verity on the root 
partition. However, the roothash= kernel parameter only disables root 
auto-discovery — non-root partitions (swap, /home, /var, /srv, /var/tmp) are 
still auto-discovered and mounted. The generator is shipped unmasked in the 
RHEL systemd-udev subpackage, and no kernel command line parameter in the 
measured UKI addon disables it. Additionally, the PodVM measurement script 
captures PCRs 3, 9, 11, and 12, but not PCR 5 (GPT partition table), so 
partition table modifications are not detected by remote attestation.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_