Processor vulnerability
CVE-2025-54502
The SMM driver for the platform configuration blob used a UEFI boot service at run time, so ring 0 code could take over System Management Mode.
- Name
- LocateProtocol in the APCB SMM driver
- Vulnerability
- AMD AGESA, SMM and BIOS firmware
- Kind
- Firmware
- CVE published
- 2026-04-16 CVE record
- Advisories
- AMD-SB-7054
The APCB SMM driver of AMD’s firmware looked up a protocol through
the LocateProtocol service of the UEFI boot services table from
inside an SMI handler. That table lives outside SMRAM and can be
changed by the operating system after boot, so a privileged attacker
at ring 0 could reach code execution in System Management Mode.
AMD’s bulletin lists EPYC from the 7002 to the 9005 series and
client lines up to the Ryzen 9000 and Ryzen AI 300, fixed in PI
firmware released from October 2025.What the sources say of each microarchitecture.
Affected processors
6 of the 6 microarchitectures listed are affected in all or some of their models.
| Microarchitecture | Status | Detail | Source |
|---|---|---|---|
| Zen | Affected | Athlon 3000 mobile, Ryzen Embedded R1000 and V1000 | amd.com |
| Zen+ | Affected | Ryzen Embedded R2000 | amd.com |
| Zen 2 | Affected | EPYC 7002, Ryzen 3000 desktop, Ryzen 4000, Ryzen 7020, Threadripper PRO 3000 WX, EPYC Embedded 7002, Ryzen Embedded V2000 | amd.com |
| Zen 3 | Affected | EPYC 7003, Ryzen 5000, Ryzen 6000, Ryzen 7030 and 7035, Threadripper PRO 5000 WX, EPYC Embedded 7003, Ryzen Embedded 5000 and V3000 | amd.com |
| Zen 4 | Affected | EPYC 4004, 8004 and 9004, Ryzen 7000, 7040, 7045, 8000 and 8040, Threadripper 7000, Ryzen Z1, EPYC Embedded 8004 and 9004, Ryzen Embedded 7000 and 8000 | amd.com |
| Zen 5 | Affected | EPYC 9005, Ryzen 9000 and 9000HX, Ryzen AI 300 and AI Max 300, Threadripper 9000, EPYC Embedded 9005, Ryzen Embedded 9000 | amd.com |
Mitigations
- Firmware: PI firmware such as RomePI 1.0.0.P, MilanPI 1.0.0.J, GenoaPI 1.0.0.H, TurinPI 1.0.0.9 and ComboAM5PI 1.2.8.0, and the other versions the bulletin lists. Source.
Related CVEs
- CVE-2020-12890 SMM callout in AGESA
- CVE-2020-12954 Chipset option bypasses SPI ROM protection
- CVE-2021-26316 BIOS communication buffer
- CVE-2021-26317 SMM protocol not verified
- CVE-2021-26384 SMI trigger data
- CVE-2021-26388 BIOS directory search
- CVE-2021-39298 SMM interrupt handler
- CVE-2022-23820 SMM communication buffer
- CVE-2022-23821 SPI ROM writes through SMM
- CVE-2022-23829 SPI lock bypass
- CVE-2023-20555 CpmDisplayFeatureSmm bit overwrite
- CVE-2023-20558 AmdCpmOemSmm control flow
- CVE-2023-20559 AmdCpmGpioInitSmm control flow
- CVE-2023-20563 SMM code protections
- CVE-2023-20565 SMM code protections (second CVE)
- CVE-2023-20571 SMM race with CVE-2018-8897
- CVE-2023-20576 AGESA data authenticity
- CVE-2023-20577 SMM module heap overflow
- CVE-2023-20578 SMM communication buffer race
- CVE-2023-20579 SPI protection bypass from ring 0
- CVE-2023-20587 SPI flash through SMM
- CVE-2023-20594 DXE driver variables (1)
- CVE-2023-20596 SMM Supervisor initialization
- CVE-2023-20597 DXE driver variables (2)
- CVE-2023-31315 SMM lock bypass
- CVE-2023-31342 SMM handler overwrites SMRAM (1)
- CVE-2023-31343 SMM handler overwrites SMRAM (2)
- CVE-2023-31345 SMM handler overwrites SMRAM (3)
- CVE-2024-0179 SMM callout in AmdCpmDisplayFeatureSMM
- CVE-2024-21924 SMM callout in AmdPlatformRasSspSmm
- CVE-2024-21925 AmdPspP2CmboxV2 input validation
- CVE-2024-21947 SMM arbitrary memory write
- CVE-2024-36310 SMM communication buffer bounds
- CVE-2024-36311 SMM communication buffer race
- CVE-2024-36326 RomArmor on resume
- CVE-2024-36343 SMM buffer and TSEG
- CVE-2024-36345 AMD OverDrive SMM module
- CVE-2024-36354 DIMM SPD data and SMM
- CVE-2024-36355 SMM handler and S3 resume
- CVE-2025-29950 SMM stack overwrite
- CVE-2026-0438 SMM callout