{"id":"CVE-2026-60138","kind":"vulnerability","aliases":["CVE-2026-60138"],"related":[],"title":"Intel TDX MigTD: out-of-range pointer offset lets privileged software escalate","description":"Use of out-of-range pointer offset in the MigTD's virtio-vsock implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.","summary":"The MigTD component of Intel's TDX Migration Trust Domain has an out-of-range pointer offset in its virtio-vsock code. A privileged system software adversary on the host can escalate privileges and affect confidentiality, integrity and availability.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"MigTD","fixed":["0.7.2"],"affected":"< 0.7.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["confidential-computing","infrastructure","intel-tdx","migtd","virtio-vsock"],"not_affected_if":["no-tdx-migration"],"how_to_check":"Check the MigTD reference software version you build or deploy (the intel/MigTD release); any version before 0.7.2 is affected. Also check whether your TDX platform uses live migration with MigTD.","fix":"Update MigTD to 0.7.2 or later (Intel INTEL-SA-01580)","status":"open","published_at":"2026-11-10T18:17:43+00:00","first_seen_at":"2026-11-10T18:22:59+00:00","triaged_at":"2026-11-10T18:24:28+00:00","updated_at":"2026-11-10T18:25:54+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-10T18:24:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Intel TDX MigTD: out-of-range pointer offset lets privileged software escalate","impact":"high","summary":"The MigTD component of Intel's TDX Migration Trust Domain has an out-of-range pointer offset in its virtio-vsock code. A privileged system software adversary on the host can escalate privileges and affect confidentiality, integrity and availability.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["intel-tdx","migtd","virtio-vsock","confidential-computing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"privileged software escalates to hypervisor-level control of the trust domain","analyst_note":"Find the affected MigTD versions and Intel's advisory with the fixed release at https://nvd.nist.gov/vuln/detail/CVE-2026-60138 and Intel's security center.","how_to_check":"unknown","plain_action":"","product_name":"Intel TDX MigTD","needs_analyst":true,"not_affected_if":["no-tdx-migration"],"who_is_affected":"Affects hosts and cloud platforms running Intel TDX with the MigTD migration trust domain and its virtio-vsock implementation. The sources do not say which versions are affected or how to confirm the component is in use.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000729,"input_tokens":4687,"output_tokens":520,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected MigTD versions and Intel's advisory with the fixed release at https://nvd.nist.gov/vuln/detail/CVE-2026-60138 and Intel's security center.","search":"'-2026':15A,18A '-60138':16A,19A '0':100C 'access':133C 'adversari':60B,110C 'affect':68B 'allow':103C 'attack':120C,135C 'avail':72B,160C,175C 'code':55B 'combin':115C 'complex':119C 'compon':34B 'comput':23B 'confidenti':22B,69B,155C,170C 'confidential-comput':21B 'cve':14A,17A 'domain':41B,96C 'enabl':122C 'escal':13A,65B,105C,123C 'high':156C,158C,161C 'host':63B 'hypervisor':101C 'impact':153C,177C 'implement':88C 'infrastructur':24B 'integr':70B,157C,172C 'intel':1A,26B,36B,91C 'intel-tdx':25B 'interact':148C 'intern':142C 'knowledg':143C 'let':10A 'local':132C 'low':118C 'may':102C,121C,128C,152C 'migrat':39B,94C 'migtd':3A,20A,28B,33B,83C,97C 'none':171C,173C,176C 'occur':130C 'offset':9A,49B,80C 'out-of-rang':4A,44B,75C 'pointer':8A,48B,79C 'potenti':129C,150C 'present':139C 'privileg':11A,57B,66B,107C,113C,125C 'r':92C 'rang':7A,47B,78C 'requir':136C,145C 'result':127C,166C 'ring':99C 'softwar':12A,59B,109C 'special':141C 'subsequ':168C 'system':58B,108C,165C,169C 'tdx':2A,27B,38B,93C 'trust':40B,95C 'use':73C 'user':114C,147C 'via':131C 'virtio':30B,53B,86C 'virtio-vsock':29B,52B,85C 'vsock':31B,54B,87C 'vulner':151C,164C 'within':98C 'without':140C","nicknames":[],"mitigations":[],"who_affected":"Operators of Intel TDX hosts and cloud platforms that use the MigTD migration trust domain (Intel MigTD reference software before 0.7.2). The attacker must be privileged system software on the host. Skip it if you do not use TDX live migration / MigTD.","tier":"B","verified":{"fix":{"at":"2026-11-10T18:25:54Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html","run_id":2490},"products":{"at":"2026-11-10T18:25:54Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html","run_id":2490},"how_to_check":{"at":"2026-11-10T18:25:54Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html","run_id":2490},"who_affected":{"at":"2026-11-10T18:25:54Z","by":"analyst","doc":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html","run_id":2490}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["migtd"],"ptokens":["migtd"],"labels":["confidentialcomputing","high","infrastructure","inteltdx","migtd","virtiovsock"],"campaign_type":null,"search_a":"'-2026':15A,18A '-60138':16A,19A 'cve':14A,17A 'escal':13A 'intel':1A 'let':10A 'migtd':3A,20A 'offset':9A 'out-of-rang':4A 'pointer':8A 'privileg':11A 'rang':7A 'softwar':12A 'tdx':2A","search_b":"'adversari':60B 'affect':68B 'avail':72B 'code':55B 'compon':34B 'comput':23B 'confidenti':22B,69B 'confidential-comput':21B 'domain':41B 'escal':65B 'host':63B 'infrastructur':24B 'integr':70B 'intel':26B,36B 'intel-tdx':25B 'migrat':39B 'migtd':28B,33B 'offset':49B 'out-of-rang':44B 'pointer':48B 'privileg':57B,66B 'rang':47B 'softwar':59B 'system':58B 'tdx':27B,38B 'trust':40B 'virtio':30B,53B 'virtio-vsock':29B,52B 'vsock':31B,54B","search_c":"'0':100C 'access':133C 'adversari':110C 'allow':103C 'attack':120C,135C 'avail':160C,175C 'combin':115C 'complex':119C 'confidenti':155C,170C 'domain':96C 'enabl':122C 'escal':105C,123C 'high':156C,158C,161C 'hypervisor':101C 'impact':153C,177C 'implement':88C 'integr':157C,172C 'intel':91C 'interact':148C 'intern':142C 'knowledg':143C 'local':132C 'low':118C 'may':102C,121C,128C,152C 'migrat':94C 'migtd':83C,97C 'none':171C,173C,176C 'occur':130C 'offset':80C 'out-of-rang':75C 'pointer':79C 'potenti':129C,150C 'present':139C 'privileg':107C,113C,125C 'r':92C 'rang':78C 'requir':136C,145C 'result':127C,166C 'ring':99C 'softwar':109C 'special':141C 'subsequ':168C 'system':108C,165C,169C 'tdx':93C 'trust':95C 'use':73C 'user':114C,147C 'via':131C 'virtio':86C 'virtio-vsock':85C 'vsock':87C 'vulner':151C,164C 'within':98C 'without':140C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T18:17:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"secure@intel.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-60138","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60138","severity":null,"published_at":"2026-11-10T18:17:43+00:00","modified_at":"2026-11-10T18:17:43+00:00","first_seen_at":"2026-11-10T18:22:59+00:00","fetched_at":"2026-11-10T18:22:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-60138:2490","url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html","severity":null,"published_at":"2026-11-10T18:25:54+00:00","modified_at":"2026-11-10T18:25:54+00:00","first_seen_at":"2026-11-10T18:25:54+00:00","fetched_at":"2026-11-10T18:25:54+00:00","note":"Intel INTEL-SA-01580 (rev 1.0, 2026-11-10) lists CVE-2026-60138: MigTD < 0.7.2 affected, fixed in 0.7.2. No exploitation or PoC found. web-cli unavailable in this environment; only the advisory was read via WebFetch (NVD page returned nothing useful); X/discussion not searched.","cites":["https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html"]}],"documents":[{"id":117041,"url":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01580.html","title":"INTEL-SA-01580 Intel TDX Migration Trust Domain (MigTD) Advisory","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}