Intel TDX MigTD: Denial of service via vsock packet handling
Summary
A flaw in the vsock packet handling of Intel's MigTD component for Intel TDX confidential computing allows improper validation of a specified quantity in input. An attacker with privileged system-software access on the local host can cause a denial of service that affects the availability of the trust domain. Confidentiality and integrity are rated as not affected, and no remote or internet-facing attack path is described.
Affected
- Intel(R) TDX Migration Trust Domain (MigTD)
- Affected versions: Unknown. The CVE record refers to Intel's advisory INTEL-SA-01580 for version details.
Fixed in
- Unknown. Check Intel advisory INTEL-SA-01580 for reference software updates.
Workaround
- No vendor workaround confirmed.
- Limit who holds hypervisor or host-administrator rights.
- Monitor for unusual behaviour related to vsock packet handling.
Exploitation
- No evidence of exploitation in the wild.
- Not known to be listed in CISA KEV (no evidence found in research).
- No public proof of concept found.
Our recommendation
- If you do not use Intel TDX or MigTD, no action is needed beyond routine monitoring.
- If you run TDX-based confidential VMs or cloud services, ask your provider or check Intel advisory INTEL-SA-01580 and apply the MigTD update once confirmed.
- Patch the whole MigTD component, as the advisory covers several related CVEs.
- Restrict privileged access on hosts and monitor for anomalies.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Intel Security Advisory INTEL-SA-01580 intel.com
- Strix CVE-2026-60071 www.strix.ai
- OffSeq Radar: CVE-2026-60071 radar.offseq.com
- Intel Security Center www.intel.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 11:34.
Original description (NVD)
Improper validation of specified quantity in input in the MigTD vsock packet handling for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow a denial of service. System software adversary with a privileged user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.