From d67a78c5d5b628c46bdad40a9513dddbc86f5eb1 Mon Sep 17 00:00:00 2001
From: Azure Linux Security Servicing Account
 <azurelinux-security@microsoft.com>
Date: Fri, 21 Aug 2026 02:14:27 +0000
Subject: [PATCH] Patch swtpm for CVE-2026-75900

---
 SPECS/swtpm/CVE-2026-75900.patch | 41 ++++++++++++++++++++++++++++++++
 SPECS/swtpm/swtpm.spec           |  6 ++++-
 2 files changed, 46 insertions(+), 1 deletion(-)
 create mode 100644 SPECS/swtpm/CVE-2026-75900.patch

diff --git a/SPECS/swtpm/CVE-2026-75900.patch b/SPECS/swtpm/CVE-2026-75900.patch
new file mode 100644
index 00000000000..9913c86fc1f
--- /dev/null
+++ b/SPECS/swtpm/CVE-2026-75900.patch
@@ -0,0 +1,41 @@
+From d7f0a8a1656c3189652caf0483d3f1998d739d4e Mon Sep 17 00:00:00 2001
+From: Suraj Theekshana <surajtheekshanahackerone@gmail.com>
+Date: Fri, 14 Aug 2026 02:34:48 +0000
+Subject: [PATCH] swtpm: Fix length check in SWTPM_NVRAM_CheckHeader()
+
+The length of an incoming blob was compared against sizeof(bh), which is
+the size of the blobheader pointer rather than the size of the structure.
+blobheader is packed and 10 bytes wide, so on 64-bit builds a blob of 8
+bytes passed the check and the subsequent read of bh->totlen, which
+occupies offsets 6-9, accessed 2 bytes beyond the buffer. On 32-bit builds
+the check admitted 4 bytes and the overread was 6.
+
+A blob of this length can be supplied via CMD_SET_STATEBLOB, where
+ctrlchannel_receive_state() allocates exactly the length the client
+declares.
+
+Fixes: CVE-2026-75900
+
+Signed-off-by: Suraj Theekshana <surajtheekshanahackerone@gmail.com>
+Signed-off-by: rpm-build <rpm-build>
+Upstream-reference: https://github.com/stefanberger/swtpm/commit/dc5f5ee3d8261a4d9814ad5da69164a118822401.patch
+---
+ src/swtpm/swtpm_nvstore.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/swtpm/swtpm_nvstore.c b/src/swtpm/swtpm_nvstore.c
+index ff5cb80..eeb55ba 100644
+--- a/src/swtpm/swtpm_nvstore.c
++++ b/src/swtpm/swtpm_nvstore.c
+@@ -1097,7 +1097,7 @@ SWTPM_NVRAM_CheckHeader(unsigned char *data, uint32_t length,
+     blobheader *bh = (blobheader *)data;
+     uint16_t hdrsize;
+ 
+-    if (length < sizeof(bh)) {
++    if (length < sizeof(*bh)) {
+         if (!quiet)
+             logprintf(STDERR_FILENO,
+                       "not enough bytes for header: %u\n", length);
+-- 
+2.45.4
+
diff --git a/SPECS/swtpm/swtpm.spec b/SPECS/swtpm/swtpm.spec
index fcbfa7bd5cd..acd71462304 100644
--- a/SPECS/swtpm/swtpm.spec
+++ b/SPECS/swtpm/swtpm.spec
@@ -12,12 +12,13 @@
 Summary: TPM Emulator
 Name:           swtpm
 Version:        0.8.1
-Release:        5%{?dist}
+Release:        6%{?dist}
 License:        BSD-3-Clause
 URL:            http://github.com/stefanberger/swtpm
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
 Source0:        %{url}/archive/%{gitcommit}/%{name}-%{gitshortcommit}.tar.gz
+Patch0:         CVE-2026-75900.patch
 
 BuildRequires:  make
 BuildRequires:  git-core
@@ -193,6 +194,9 @@ fi
 %{_datadir}/swtpm/swtpm-create-tpmca
 
 %changelog
+* Fri Aug 21 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 0.8.1-6
+- Patch for CVE-2026-75900
+
 * Tue Sep 03 2024 Neha Agarwal <nehaagarwal@microsoft.com> - 0.8.1-5
 - Add missing Vendor and Distribution tags.