In the Linux kernel, the following vulnerability has been resolved:
x86/tdx: Zero out the missing RSI in TDX_HYPERCALL macro
In the TDX_HYPERCALL asm, after the TDCALL instruction returns from the untrusted VMM, the registers that the TDX guest shares to the VMM need to be cleared to avoid speculative execution of VMM-provided values.
RSI is specified in the bitmap of those registers, but it is missing when zeroing out those registers in the current TDX_HYPERCALL.
It was there when it was originally added in commit 752d13305c78 ("x86/tdx: Expand __tdx_hypercall() to handle more arguments"), but was later removed in commit 1e70c680375a ("x86/tdx: Do not corrupt frame-pointer in __tdx_hypercall()"), which was correct because %rsi is later restored in the "pop %rsi". However a later commit 7a3a401874be ("x86/tdx: Drop flags from __tdx_hypercall()") removed that "pop %rsi" but forgot to add the "xor %rsi, %rsi" back.
Fix by adding it back.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade kernel-azureUpgrade dtb-marvellUpgrade kernel-64kb-optionalUpgrade dtb-allwinnerUpgrade kernel-debugUpgrade kernel-develUpgrade kernel-devel-azureUpgrade kernel-azure-optionalUpgrade dtb-lgUpgrade gfs2-kmp-64kbUpgrade gfs2-kmp-rtUpgrade kernel-64kbUpgrade kselftests-kmp-64kbUpgrade ocfs2-kmp-defaultUpgrade kernel-azure-extraUpgrade ocfs2-kmp-64kbUpgrade dtb-freescaleUpgrade kernel-azure-develUpgrade kernel-docs-htmlUpgrade kernel-zfcpdumpUpgrade kernel-rt-vdsoUpgrade dtb-amazonUpgrade gfs2-kmp-defaultUpgrade reiserfs-kmp-64kbUpgrade dtb-exynosUpgrade kernel-rtUpgrade kernel-debug-vdsoUpgrade kernel-source-rtUpgrade kernel-kvmsmall-vdsoUpgrade kernel-debug-develUpgrade kernel-source-azureUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-obs-buildUpgrade kernel-azure-livepatch-develUpgrade cluster-md-kmp-rtUpgrade cluster-md-kmp-azureUpgrade dtb-hisiliconUpgrade kernel-rt_debug-develUpgrade dtb-qcomUpgrade kernel-sourceUpgrade kernel-default-livepatchUpgrade dtb-appleUpgrade kernel-kvmsmallUpgrade kernel-source-vanillaUpgrade kernel-default-develUpgrade kselftests-kmp-azureUpgrade kernel-default-vdsoUpgrade kernel-64kb-livepatch-develUpgrade dtb-caviumUpgrade dtb-alteraUpgrade dtb-broadcomUpgrade kernel-kvmsmall-develUpgrade dlm-kmp-64kbUpgrade kernel-default-optionalUpgrade ocfs2-kmp-rtUpgrade kernel-syms-azureUpgrade kernel-rt-optionalUpgrade gfs2-kmp-azureUpgrade kernel-syms-rtUpgrade dtb-armUpgrade kernel-docsUpgrade kernel-rt-livepatch-develUpgrade kernel-defaultUpgrade kernel-symsUpgrade kernel-default-baseUpgrade reiserfs-kmp-rtUpgrade reiserfs-kmp-defaultUpgrade dtb-rockchipUpgrade kernel-rt-develUpgrade kernel-debug-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade dlm-kmp-rtUpgrade ocfs2-kmp-azureUpgrade kernel-rt-extraUpgrade dtb-socionextUpgrade dtb-apmUpgrade kselftests-kmp-defaultUpgrade dtb-xilinxUpgrade dtb-mediatekUpgrade kselftests-kmp-rtUpgrade kernel-default-base-rebuildUpgrade kernel-64kb-extraUpgrade kernel-macrosUpgrade dtb-renesasUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-devel-rtUpgrade kernel-default-extraUpgrade dtb-nvidiaUpgrade reiserfs-kmp-azureUpgrade kernel-64kb-develUpgrade dtb-amlogicUpgrade kernel-azure-vdsoUpgrade dtb-sprdUpgrade kernel-rt_debug-vdsoUpgrade kernel-obs-qaUpgrade kernel-rt_debugUpgrade dlm-kmp-azureUpgrade dtb-amdUpgrade dlm-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade kernel-default-livepatch-devel | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-nvidia-6.5 | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub