RUSTSEC-2026-0485

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2026-0485

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0485.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2026-0485

Aliases

CVE-2026-20763
GHSA-wgvc-hf5h-m5h7

Published

2026-08-11T12:00:00Z

Modified

2026-11-11T08:45:02Z

Severity

4.6 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

`enter_l2_vcpu` passes the wrong RCX operand to `TDG.VP.ENTER`

Details

tdx_guest::tdcall::enter_l2_vcpu() invokes the TDG.VP.ENTER TDCALL. RCX must carry the L2 VM index in bits 53:52 and the invalidation control value (InvdTranslations, 0 to 3) in bits 1:0. The function computed that value as (l2_vm_idx << 52) | (invd_translations as u64), but then passed the raw l2_vm_idx in RCX instead.

As a result, the TDX module received an operand that differs from the caller's request. The VM index field was 0, and the low bits of the index were interpreted as the invalidation control value. For example, VM 1 with InvdTlb (2) should produce 0x0010_0000_0000_0002, but produced 0x1.

Intel describes the issue as an incorrect calculation and classifies it as escalation of privilege, with a CVSS 4.0 base score of 4.6, in INTEL-SA-01462.

The flaw was corrected in commit 311d33b, released in 0.3.1, which passes the computed RCX value.

Reported by Borys Tsyrulnikov.

Database specific

{
    "license": "CC0-1.0"
}

References

Affected packages

crates.io / tdx-guest

Package

Name: tdx-guest; View open source insights on deps.dev
Purl: pkg:cargo/tdx-guest

Affected ranges

Type: SEMVER
Events: Introduced

0.1.8

Fixed

0.3.1

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "arch": [],
        "functions": [
            "tdx_guest::tdcall::enter_l2_vcpu"
        ],
        "os": []
    }
}