Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in Keylime. An attacker with root access on an enrolled monitored machine, where the Keylime agent runs, can exploit a vulnerability in the Keylime verifier. The verifier uses a hardcoded challenge nonce for Trusted Platform Module (TPM) quote attestation instead of a cryptographically random value. This allows the attacker to stockpile valid TPM quotes and replay them to evade detection after compromising the system. This issue affects only the push model deployment.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
A CVE-2026-6420 no Keylime permitia replay de TPM quotes em máquinas #Fedora. A correção veio na v7.14.2. Saiba mais: -> http://tinyurl.com/3m9h3ntf https://t.co/POQxML012i
Post summary
CVE-2026-6420 enabled replay of TPM quotes in Keylime on Fedora; the issue is fixed in v7.14.2 and further details are provided via a link.
Fedora has released Keylime 7.14.2 for Fedora 43 and 44 to fix CVE-2026-6420, a security bypass in the keylime-selinux policy caused by a hardcoded TPM quote nonce, Linuxsecurity reported. https://threatcluster.io/cluster/critical-security-bypass-in-fedora-keylime-affects-multiple--1e46883f
Post summary
Fedora’s Keylime 7.14.2 update addresses CVE‑2026‑6420, a security bypass via a hardcoded TPM quote nonce, with no evidence of a PoC, exploit, or active attacks reported.