Observable discrepancy in AMD products - CVE-2025-54505

Vulnerability identifier: #VU126567

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-54505

CWE-ID: CWE-203

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to transient execution in floating-point divisor unit when executing floating-point operations in privileged code. A local user can sample data from the floating-point divisor unit to disclose sensitive information.

The issue affects systems with SMT enabled as well as systems without SMT.

AMD EPYC 7001 Processors
AMD EPYC Embedded 3000
AMD Athlon 3000 Series Processors with Radeon Graphics
AMD Ryzen 3000 Series Processors with Radeon Graphics
AMD Ryzen PRO 3000 Series Processors with Radeon Vega Graphics
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Basesystem Module
Server Applications Module
openSUSE Leap
Ubuntu
Fedora
Citrix XenServer
xen-devel
xen
xen-libs-debuginfo
xen-tools-domU
xen-libs-32bit
xen-debugsource
xen-tools-debuginfo
xen-tools-domU-debuginfo
xen-tools
xen-doc-html
xen-libs-debuginfo-32bit
xen-libs
xen-libs-64bit
xen-libs-32bit-debuginfo
xen-tools-xendomains-wait-disk
xen-libs-64bit-debuginfo
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-nvidia-tegra (Ubuntu package)
linux-nvidia-tegra-5.15 (Ubuntu package)
linux-intel-iot-realtime (Ubuntu package)
linux-ibm-5.15 (Ubuntu package)
linux-intel-iotg (Ubuntu package)
linux-azure (Ubuntu package)
linux-azure-5.15 (Ubuntu package)
linux-azure-fips (Ubuntu package)
linux-azure-fde (Ubuntu package)
linux-fips (Ubuntu package)
linux-hwe-6.8 (Ubuntu package)
linux-ibm (Ubuntu package)
linux-oracle-6.8 (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-aws-6.8 (Ubuntu package)
linux-azure-fde-6.8 (Ubuntu package)
linux-gcp-fips (Ubuntu package)
linux-raspi (Ubuntu package)

Cybersecurity Help is currently unaware of any official solution to address this vulnerability. AMD recommends users should contact their OS vendor regarding available mitigations. 

xen-devel - addressed in versions 4.12.4_68-3.142.1, 4.14.6_30-150300.3.97.1, 4.16.7_08-150400.4.81.2, 4.17.6_08-150500.3.65.1, 4.18.5_16-150600.3.45.1, 4.20.3_02-150700.3.33.1
xen - addressed in versions 4.12.4_68-3.142.1, 4.14.6_30-150300.3.97.1, 4.16.7_08-150400.4.81.2, 4.17.6_08-150500.3.65.1, 4.18.5_16-150600.3.45.1, 4.20.3_02-150700.3.33.1
xen-libs-debuginfo - addressed in versions 4.12.4_68-3.142.1, 4.14.6_30-150300.3.97.1, 4.16.7_08-150400.4.81.2, 4.17.6_08-150500.3.65.1, 4.18.5_16-150600.3.45.1, 4.20.3_02-150700.3.33.1
xen-tools-domU - addressed in versions 4.12.4_68-3.142.1, 4.14.6_30-150300.3.97.1, 4.16.7_08-150400.4.81.2, 4.17.6_08-150500.3.65.1, 4.18.5_16-150600.3.45.1, 4.20.3_02-150700.3.33.1
xen-libs-32bit - addressed in versions 4.12.4_68-3.142.1, 4.14.6_30-150300.3.97.1, 4.16.7_08-150400.4.81.2, 4.17.6_08-150500.3.65.1, 4.18.5_16-150600.3.45.1
xen-debugsource - addressed in versions 4.12.4_68-3.142.1, 4.14.6_30-150300.3.97.1, 4.16.7_08-150400.4.81.2, 4.17.6_08-150500.3.65.1, 4.18.5_16-150600.3.45.1, 4.20.3_02-150700.3.33.1
xen-tools-debuginfo - addressed in versions 4.12.4_68-3.142.1, 4.14.6_30-150300.3.97.1, 4.16.7_08-150400.4.81.2, 4.17.6_08-150500.3.65.1, 4.18.5_16-150600.3.45.1, 4.20.3_02-150700.3.33.1
xen-tools-domU-debuginfo - addressed in versions 4.12.4_68-3.142.1, 4.14.6_30-150300.3.97.1, 4.16.7_08-150400.4.81.2, 4.17.6_08-150500.3.65.1, 4.18.5_16-150600.3.45.1, 4.20.3_02-150700.3.33.1
xen-tools - addressed in versions 4.12.4_68-3.142.1, 4.14.6_30-150300.3.97.1, 4.16.7_08-150400.4.81.2, 4.17.6_08-150500.3.65.1, 4.18.5_16-150600.3.45.1, 4.20.3_02-150700.3.33.1
xen-doc-html - addressed in versions 4.12.4_68-3.142.1, 4.14.6_30-150300.3.97.1, 4.16.7_08-150400.4.81.2, 4.17.6_08-150500.3.65.1, 4.18.5_16-150600.3.45.1
xen-libs-debuginfo-32bit - update to 4.12.4_68-3.142.1
xen-libs - addressed in versions 4.12.4_68-3.142.1, 4.14.6_30-150300.3.97.1, 4.16.7_08-150400.4.81.2, 4.17.6_08-150500.3.65.1, 4.18.5_16-150600.3.45.1, 4.20.3_02-150700.3.33.1
xen-libs-64bit - addressed in versions 4.14.6_30-150300.3.97.1, 4.16.7_08-150400.4.81.2, 4.17.6_08-150500.3.65.1, 4.18.5_16-150600.3.45.1
xen-libs-32bit-debuginfo - addressed in versions 4.14.6_30-150300.3.97.1, 4.16.7_08-150400.4.81.2, 4.17.6_08-150500.3.65.1, 4.18.5_16-150600.3.45.1
xen-tools-xendomains-wait-disk - addressed in versions 4.14.6_30-150300.3.97.1, 4.16.7_08-150400.4.81.2, 4.17.6_08-150500.3.65.1, 4.18.5_16-150600.3.45.1, 4.20.3_02-150700.3.33.1
xen-libs-64bit-debuginfo - addressed in versions 4.14.6_30-150300.3.97.1, 4.16.7_08-150400.4.81.2, 4.17.6_08-150500.3.65.1, 4.18.5_16-150600.3.45.1
xen - addressed in versions 4.19.5-2.fc42, 4.20.3-2.fc43, 4.21.1-2.fc44
linux (Ubuntu package) - addressed in versions 5.15.0.184.155, 5.15.0-184.194, 5.15.0-184.194~20.04.1, 5.15.0.186.166, 5.15.0-186.196, 5.15.0-186.196~20.04.1, 5.15.0.1075.78, 5.15.0-1075.79, 5.15.0.1095.94, 5.15.0-1095.103, 5.15.0.1104.100, 5.15.0-1104.109, 5.15.0.1108.107, 5.15.0-1108.114, 5.15.0.1111.115, 5.15.0-1111.120+fips1, 5.15.0.1112.102, 5.15.0.1112.109, 5.15.0-1112.122, 5.15.0-1112.122+fips1, 6.8.0-136.136, 6.8.0-1046.50, 6.8.0-1059.67, 6.8.0-1064.72, 6.8.0-1064.72~22.04.1, 6.8.1-1056.57, 6.8.1-1056.57~22.04.2, 7.0.0-27.27
linux-aws (Ubuntu package) - addressed in versions 5.15.0.186.109, 5.15.0-186.196+fips1, 5.15.0.1106.103, 5.15.0-1106.110, 5.15.0.1107.107, 5.15.0-1107.108, 5.15.0.1112.108, 5.15.0.1112.115, 5.15.0-1112.119, 5.15.0-1112.119+fips1, 5.15.0-1112.119~20.04.1, 6.8.0-1061.64+1
linux-nvidia-tegra (Ubuntu package) - addressed in versions 5.15.0-1053.53, 5.15.0.1053.55, 5.15.0.1064.64, 5.15.0-1064.66
linux-nvidia-tegra-5.15 (Ubuntu package) - update to 5.15.0-1064.66~20.04.1
linux-intel-iot-realtime (Ubuntu package) - addressed in versions 5.15.0-1104.106, 5.15.0.1104.108, 5.15.0-1107.113~20.04.1
linux-ibm-5.15 (Ubuntu package) - update to 5.15.0-1106.110~20.04.1
linux-intel-iotg (Ubuntu package) - addressed in versions 5.15.0.1107.106, 5.15.0-1107.113
linux-azure (Ubuntu package) - addressed in versions 5.15.0.1109.105, 5.15.0-1109.115, 5.15.0.1117.115, 5.15.0-1117.126, 6.8.0-1063.71, 6.8.0-1063.71~22.04.1, 7.0.0-1009.9, 7.0.0-1010.10
linux-azure-5.15 (Ubuntu package) - addressed in versions 5.15.0-1109.115~20.04.1, 5.15.0-1117.126~20.04.1, 5.15.0-1117.126~20.04.2
linux-azure-fips (Ubuntu package) - addressed in versions 5.15.0.1117.102, 5.15.0-1117.126+fips1, 6.8.0-1063.71+fips2
linux-azure-fde (Ubuntu package) - addressed in versions 5.15.0-1117.126, 6.8.0-1062.69
linux-fips (Ubuntu package) - addressed in versions 6.8.0-136.136+fips2, 6.8.0-136.136.2, 6.8.0-136.136.2~22.04.1, 6.8.0-1058.61
linux-hwe-6.8 (Ubuntu package) - update to 6.8.0-136.136~22.04.1
linux-ibm (Ubuntu package) - addressed in versions 6.8.0-1030.31, 6.8.0-1033.34, 6.8.0-1061.62, 6.8.0-1061.62~22.04.1
linux-oracle-6.8 (Ubuntu package) - update to 6.8.0-1058.61~22.04.1
linux-nvidia (Ubuntu package) - addressed in versions 6.8.0-1059.62, 6.8.0-1059.62.1, 6.8.0-1059.62~22.04.1, 7.0.0-1013.13
linux-aws-6.8 (Ubuntu package) - addressed in versions 6.8.0-1061.64+fips1, 6.8.0-1061.64~22.04.1
linux-azure-fde-6.8 (Ubuntu package) - update to 6.8.0-1062.69~22.04.1
linux-gcp-fips (Ubuntu package) - update to 6.8.0-1064.72+fips1
linux-raspi (Ubuntu package) - update to 7.0.0-1014.14

• https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7053.html

• Information disclosure in AMD CPUs
• SUSE update for xen
• Fedora 44 update for xen
• SUSE update for xen
• Fedora 43 update for xen
• Fedora 42 update for xen
• Multiple vulnerabilities in Citrix XenServer
• SUSE update for xen
• SUSE update for xen
• SUSE update for xen
• SUSE update for xen
• Ubuntu update for linux
• Ubuntu update for linux-raspi
• Ubuntu update for linux-nvidia
• Ubuntu update for linux
• Ubuntu update for linux-gcp-fips
• Ubuntu update for linux-nvidia-tegra-5.15
• Ubuntu update for linux
• Ubuntu update for linux-oracle-6.8
• Ubuntu update for linux-fips
• Ubuntu update for linux-ibm-5.15
• Ubuntu update for linux-nvidia-tegra
• Ubuntu update for linux-aws
• Ubuntu update for linux-nvidia
• Ubuntu update for linux-azure
• Ubuntu update for linux-azure-fde
• Ubuntu update for linux-azure
• Ubuntu update for linux-azure-fde-6.8
• Ubuntu update for linux-azure-fips
• Ubuntu update for linux-azure-fde
• Ubuntu update for linux-azure
• Ubuntu update for linux-aws
• Ubuntu update for linux-azure-5.15
• Ubuntu update for linux-hwe-6.8
• Ubuntu update for linux-aws-6.8
• Ubuntu update for linux-ibm
• Ubuntu update for linux-azure-fips
• Ubuntu update for linux-intel-iot-realtime
• Ubuntu update for linux-intel-iotg