CVE-2026-121876: Sandboxed-containers: kernel: systemd-gpt-auto-generator: guest data leakage in confidential computing (sandboxed containers)

High 7.9 systemd

A flaw was found in the interaction between systemd-gpt-auto-generator and confidential computing guest VM images in OpenShift Sandboxed Containers (confidential peer pods). systemd-gpt-auto-generator automatically discovers and mounts GPT partitions by type GUID at boot with no user confirmation. In the confidential computing threat model, where the host/hypervisor is the adversary, a malicious host can inject partitions into the guest's virtual disk. Most critically, injecting a swap partition causes the guest kernel to page out TEE-encrypted memory to a host-controlled block device, breaking the confidentiality guarantee of the hardware TEE (AMD SEV-SNP, Intel TDX). The PodVM images use a GPT-partitioned disk with dm-verity on the root partition. However, the roothash= kernel parameter only disables root auto-discovery — non-root partitions (swap, /home, /var, /srv, /var/tmp) are still auto-discovered and mounted. The generator is shipped unmasked in the RHEL systemd-udev subpackage, and no kernel command line parameter in the measured UKI addon disables it. Additionally, the PodVM measurement script captures PCRs 3, 9, 11, and 12, but not PCR 5 (GPT partition table), so partition table modifications are not detected by remote attestation.

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

What to do now

  1. Check whether you run systemd and which version (commands below).
  2. Install the fixed version for your system: see “Patch it” below.
  3. sudo systemctl daemon-reexec (PID 1); restart systemd-resolved/networkd/logind if affected, or reboot

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

Debian
sudo apt update
sudo apt install --only-upgrade systemd libsystemd0 udev
Ubuntu
sudo apt update
sudo apt install --only-upgrade systemd libsystemd0 udev
RHEL, AlmaLinux, Rocky, Oracle
sudo dnf upgrade --refresh systemd
Fedora
sudo dnf upgrade --refresh systemd
SUSE / openSUSE
sudo zypper refresh
sudo zypper update systemd libsystemd0 udev
Amazon Linux
sudo dnf upgrade --releasever=latest systemd
Arch Linux
sudo pacman -Syu
Alpine
not used: Alpine uses OpenRC
FreeBSD
not used

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

Sources

Page generated automatically from official sources on 2026-11-12 23:19 UTC. Always confirm with your vendor's advisory.