CVE-2026-121876: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-121876 is a guest data leakage vulnerability in OpenShift Sandboxed Containers (confidential peer pods) arising from the interaction between systemd-gpt-auto-generator and confidential computing guest VM images. A malicious host or hypervisor can inject GPT partitions — most critically a swap partition — into a guest's virtual disk, causing the guest kernel to page out TEE-encrypted memory to a host-controlled block device, thereby breaking the confidentiality guarantees of AMD SEV-SNP and Intel TDX. Affected products include Red Hat's kernel, kernel-rt, openshift/ose-rhel-coreos-8, and openshift/ose-rhel-coreos-9. The vulnerability was reported by Spyros Seimenis of Edgeless Systems and publicly disclosed on November 12, 2026. It carries a CVSS v3.1 base score of 7.9 (High) (Red Hat CVE, GitHub Advisory).

The root cause is classified as CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor). systemd-gpt-auto-generator automatically discovers and mounts GPT partitions by type GUID at boot without user confirmation; while the roothash= kernel parameter disables root partition auto-discovery, non-root partitions (swap, /home, /var, /srv, /var/tmp) remain auto-discovered and mounted. The generator is shipped unmasked in the RHEL systemd-udev subpackage, and no kernel command-line parameter in the measured UKI addon disables it. Critically, the PodVM measurement script captures PCRs 3, 9, 11, and 12 but omits PCR 5 (GPT partition table), meaning partition table modifications are invisible to remote attestation. Attack vectors include: (1) swap partition injection causing TEE-encrypted memory to be paged to a host-readable device; (2) /var or /home mount replacement enabling data capture or malicious content injection; (3) LUKS auto-unlock key exposure via a host-provided vTPM; and (4) ESP/XBOOTLDR replacement to inject modified boot configuration (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation allows a malicious host or hypervisor to break the fundamental confidentiality guarantee of hardware Trusted Execution Environments (AMD SEV-SNP, Intel TDX), exposing TEE-encrypted guest memory contents by forcing the guest kernel to swap pages to a host-controlled block device. Beyond memory disclosure, the attacker can capture or tamper with data written to guest filesystem paths such as /var and /home, and potentially extract LUKS auto-unlock keys via a compromised vTPM. The scope change (CVSS S:C) reflects that the impact crosses the security boundary of the confidential computing enclave into the broader host environment, with high confidentiality and integrity impact and no availability impact (Red Hat CVE, GitHub Advisory).

Exploitation requires high privileges (local access as the host/hypervisor), consistent with the confidential computing threat model where the host is the adversary. No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The CVE status is listed as "Awaiting Analysis" and no EPSS score or CISA KEV catalog entry has been identified. The vulnerability was responsibly disclosed by Spyros Seimenis of Edgeless Systems, with the publication date coordinated to align with the researcher's own advisory release on November 12, 2026 (Red Hat CVE, Red Hat Bugzilla).

1. Gain host/hypervisor control: The attacker must already control the host or hypervisor managing the confidential peer pod VM — this is the assumed adversary in the confidential computing threat model.
2. Identify target PodVM: Locate a running OpenShift Sandboxed Containers PodVM using a GPT-partitioned disk with systemd-gpt-auto-generator active and unmasked.
3. Inject a malicious GPT partition: Modify the guest's virtual disk image or attach an additional virtual block device with a GPT partition typed as swap (type GUID 0657FD6D-A4AB-43C4-84E5-0933C84B4F4F), /home, /var, /srv, or /var/tmp.
4. Trigger guest reboot or boot: On next guest boot, systemd-gpt-auto-generator automatically discovers and activates the injected partition without user confirmation, since PCR 5 is not measured and remote attestation does not detect the partition table change.
5. Exfiltrate paged memory (swap attack): With a swap partition active, the guest kernel pages out TEE-encrypted memory to the host-controlled block device; the host reads the block device to recover plaintext guest memory contents, defeating AMD SEV-SNP or Intel TDX confidentiality guarantees (Red Hat Bugzilla, Red Hat CVE).

Red Hat's released patches apply the mitigation systemd.image_policy=root=open to the kernel command line. The recommended immediate workaround is to add systemd.gpt_auto=0 to the measured kernel command line (UKI addon) to completely disable systemd-gpt-auto-generator, which is unnecessary given PodVM's explicit partition layout and dm-verity. Additional mitigations include: adding systemd.swap=0 to the kernel command line to disable swap auto-discovery specifically; masking the generator in the guest image via ln -sf /dev/null /etc/systemd/system-generators/systemd-gpt-auto-generator; including PCR 5 in the PodVM measurement script alongside PCRs 3, 9, 11, and 12; and for systemd 254+, setting a restrictive image policy via systemd.image_policy=root=verity+signed+encrypted+unprotected+absent:swap=absent:home=absent:srv=absent:var=absent:tmp=absent (Red Hat CVE).

Red Hat acknowledged the vulnerability and credited Spyros Seimenis of Edgeless Systems for the responsible disclosure, coordinating the publication date with the researcher's own advisory release on November 12, 2026. Social media activity was observed on Mastodon via accounts including @thehackerwire and @RedPacketSecurity shortly after disclosure. Coverage also appeared on security aggregators such as securityonline.info in the context of broader Red Hat vulnerability advisories (Red Hat CVE, Red Hat Bugzilla).