CVE-2026-121876
Sandboxed-containers: kernel: systemd-gpt-auto-generator: guest data leakage in confidential computing (sandboxed containers)
- High 7.9
Description
A flaw was found in the interaction between systemd-gpt-auto-generator and confidential computing guest VM images in OpenShift Sandboxed Containers (confidential peer pods). systemd-gpt-auto-generator automatically discovers and mounts GPT partitions by type GUID at boot with no user confirmation. In the confidential computing threat model, where the host/hypervisor is the adversary, a malicious host can inject partitions into the guest's virtual disk. Most critically, injecting a swap partition causes the guest kernel to page out TEE-encrypted memory to a host-controlled block device, breaking the confidentiality guarantee of the hardware TEE (AMD SEV-SNP, Intel TDX). The PodVM images use a GPT-partitioned disk with dm-verity on the root partition. However, the roothash= kernel parameter only disables root auto-discovery — non-root partitions (swap, /home, /var, /srv, /var/tmp) are still auto-discovered and mounted. The generator is shipped unmasked in the RHEL systemd-udev subpackage, and no kernel command line parameter in the measured UKI addon disables it. Additionally, the PodVM measurement script captures PCRs 3, 9, 11, and 12, but not PCR 5 (GPT partition table), so partition table modifications are not detected by remote attestation.
Key facts
- Published
- 12 Nov 2026
- Last changed
- 12 Nov 2026
- Assigned by
- redhat
- EPSS
- 0.166% likely to be exploited in the next 30 days, higher than 5.87% of CVEs (scores for 15 Nov 2026)
Severity scores
Each score is shown as its source gave it. They are not averaged or merged.
- 7.9CVSS 3.1, Highfrom the CNA (redhat)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
What to do
- Add systemd.gpt_auto=0 to the measured kernel command line (UKI addon) to completely disable systemd-gpt-auto-generator. Since the PodVM already uses explicit partition layout and dm-verity, auto-discovery is unnecessary. The patches released are using the following mitigation: `systemd.image_policy=root=open`. Alternative mitigations: - Disable swap specifically: add systemd.swap=0 to the kernel command line - Mask the generator in the guest image: ln -sf /dev/null /etc/systemd/system-generators/systemd-gpt-auto-generator - Include PCR 5 in the PodVM measurement script alongside PCRs 3, 9, 11, 12 - For systemd 254+: set restrictive image policy via systemd.image_policy=root=verity+signed+encrypted+unprotected+absent:swap=absent:home=absent:srv=absent:var=absent:tmp=absentCNA workaround statement
Historical context and remediation
This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.
No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.
Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 |
|
| Red Hat | Red Hat Enterprise Linux 6 |
|
| Red Hat | Red Hat Enterprise Linux 7 |
|
| Red Hat | Red Hat Enterprise Linux 7 |
|
| Red Hat | Red Hat Enterprise Linux 8 |
|
| Red Hat | Red Hat Enterprise Linux 8 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
|
| Red Hat | Red Hat OpenShift Container Platform 4 |
|
| Red Hat | Red Hat OpenShift Container Platform 4 |
|
| Red Hat | Red Hat OpenShift Container Platform 5 |
|
Timeline
- 16 Oct 2026 Reported to Red Hat.
- 12 Nov 2026 Made public.
- 12 Nov 2026 Published