CVE-2026-121876

A flaw was found in the interaction between systemd-gpt-auto-generator and 
confidential computing guest VM images in OpenShift Sandboxed Containers 
(confidential peer pods). systemd-gpt-auto-generator automatically discovers 
and mounts GPT partitions by type GUID at boot with no user confirmation. In 
the confidential computing threat model, where the host/hypervisor is the 
adversary, a malicious host can inject partitions into the guest's virtual 
disk. Most critically, injecting a swap partition causes the guest kernel to 
page out TEE-encrypted memory to a host-controlled block device, breaking the 
confidentiality guarantee of the hardware TEE (AMD SEV-SNP, Intel TDX).

The PodVM images use a GPT-partitioned disk with dm-verity on the root 
partition. However, the roothash= kernel parameter only disables root 
auto-discovery — non-root partitions (swap, /home, /var, /srv, /var/tmp) are 
still auto-discovered and mounted. The generator is shipped unmasked in the 
RHEL systemd-udev subpackage, and no kernel command line parameter in the 
measured UKI addon disables it. Additionally, the PodVM measurement script 
captures PCRs 3, 9, 11, and 12, but not PCR 5 (GPT partition table), so 
partition table modifications are not detected by remote attestation.