This vulnerability exists in the Linux kernel’s TDX guest interface. A host can provide a quote buffer length that exceeds the space allocated to the guest. The kernel copies the host‑specified length into guest user space, causing a buffer overread (CWE‑125) beyond the allocated memory pages. The leaked data may contain host or kernel information and can be forwarded to external attestation servers, potentially enabling cross‑container data leaks.

All Linux kernel builds that include TDX support are affected. The advisory does not specify exact kernel releases; users should verify the presence of the patch in the kernel tree or update to a version that incorporates the fix.

The CVSS score of 7.1 and an EPSS score of < 1% indicate moderate to high severity with a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attack requires a privileged actor controlling the virtualization host to set the quote buffer length. If successfully exploited, it allows an attacker to read memory beyond the guest’s allocation, leading to information disclosure across container boundaries.