x86-64.net

Processor vulnerability

CVE-2025-54505

A user-mode attacker can sample data from the floating-point divider of Zen and Zen+ processors, with or without SMT; AMD rates the risk low.

Name
Floating Point Divider State Sampling
Also known as
FP-DSS
Kind
Data sampling
CVE published
2026-04-27 CVE record
Advisories
AMD-SB-7053
Researchers found with a black-box detection framework that the floating-point divider of several generations of AMD processors can pass data from earlier operations to an attacker’s transient instructions. AMD finds both SMT and non-SMT systems affected but the risk limited, as the data is constrained and privileged code seldom divides floating-point numbers. For Zen and Zen+, setting bit 9 of MSR C001_1028 mitigates it; Linux 7.3 sets that bit on every Zen 1 processor.

Affected processors

2 of the 2 microarchitectures listed are affected in all or some of their models.

What the sources say of each microarchitecture.
MicroarchitectureStatusDetailSource
ZenAffectedLinux 7.3 treats family 17h models 00h-2Fh and 50h-5Fh as Zen 1Linux 7.3
Zen+AffectedLinux 7.3 treats family 17h models 00h-2Fh and 50h-5Fh, Zen+ among them, as Zen 1Linux 7.3

Mitigations

  • Kernel: Setting bit 9 of MSR C001_1028 (FP_CFG); Linux 7.3 does so on Zen 1 processors. Instructions: WRMSR. Source.

Sources

  1. AMD-SB-7053: Floating Point Divider State Sampling on AMD CPUs
  2. Linux 7.3 arch/x86/kernel/cpu/amd.c: FPDSS on Zen 1
  3. Linux 7.3 arch/x86/kernel/cpu/amd.c: Zen 1 models