Skip to content
Fencer Intel
high 7.0

CVE-2025-54518 json

Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructio…

published 5mo ago modified last mo. also EUVD-2025-209882

cvss
7.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 21%
public exploits
0
none known

Summary

Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a different privilege level, potentially resulting in privilege escalation.

Patch / fix

  • AMD AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics RenoirPI-FP6_1.0.0.Ed
  • AMD AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics MendocinoPI-FT6_1.0.0.7f
  • AMD AMD Ryzen™ 3000 Series Desktop Processors ComboAM4PI 1.0.0.10, ComboAM4v2 1.2.0.10
  • AMD AMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors CastlePeakWSPI-sWRX8 1.0.0.I, ChagallWSPI-sWRX8-1.0.0.D
  • AMD AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics CezannePI-FP6_1.0.1.1d
  • AMD AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics CezannePI-FP6_1.0.1.1d
  • AMD AMD Ryzen™ 4000 Series Desktop Processors ComboAM4v2 1.2.0.10
  • AMD AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics ComboAM4v2 1.2.0.10
  • AMD AMD Ryzen Embedded V2000A Series Processors EmbeddedV2KAPI-FP6 1.0.0.A
  • AMD AMD Ryzen™ Embedded V2000 Series Processors EmbeddedPI-FP6_1.0.0.D
  • Red Hat Red Hat Enterprise Linux 8 0:4.18.0-553.153.1.el8_10, 0:4.18.0-553.153.1.rt7.494.el8_10
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:4.18.0-305.201.1.el8_4
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:4.18.0-305.201.1.el8_4
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:4.18.0-372.206.1.el8_6
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 0:4.18.0-372.206.1.el8_6
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:4.18.0-477.159.1.el8_8
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:4.18.0-477.159.1.el8_8
  • Red Hat Red Hat Enterprise Linux 9 0:5.14.0-687.38.1.el9_8
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:5.14.0-427.145.1.el9_4
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:5.14.0-570.134.1.el9_6
  • Red Hat Red Hat OpenShift Container Platform 4.12 412.86.202608241157-0
  • Red Hat Red Hat OpenShift Container Platform 4.16 416.94.202609011112-0
  • Red Hat Red Hat OpenShift Container Platform 4.17 417.94.202608250221-0
  • Red Hat Red Hat OpenShift Container Platform 4.19 4.19.9.6.202608182320-0
  • Red Hat Red Hat OpenShift Container Platform 4.20 4.20.9.6.202608181658-0
  • Red Hat Red Hat OpenShift Container Platform 4.21 4.21.9.6.202608180431-0
  • Red Hat Red Hat OpenShift Container Platform 4.22 4.22.9.8.202608130832-0
  • xen Debian 12 4.17.7-0+deb12u1
  • xen Debian 13 4.20.3+127-gc42374a105-0+deb13u1
  • xen Debian 14 4.20.3+127-gc42374a105-1

debian advisories DEBIAN-CVE-2025-54518

  • linux Ubuntu 22.04 LTS 5.15.0-186.196
  • linux Ubuntu 24.04 LTS 6.8.0-136.136
  • linux Ubuntu 26.04 LTS 7.0.0-28.28
  • linux-aws Ubuntu 22.04 LTS 5.15.0-1112.119
  • linux-aws Ubuntu 24.04 LTS 6.8.0-1061.64
  • linux-aws Ubuntu 26.04 LTS 7.0.0-1009.9
  • linux-gcp Ubuntu 22.04 LTS 5.15.0-1112.122
  • linux-gcp Ubuntu 24.04 LTS 6.8.0-1064.72

ubuntu advisories UBUNTU-CVE-2025-54518

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel RHEL 9 5.14.0-687.38.1.el9_8
  • rv RHEL 9 5.14.0-687.38.1.el9_8
  • perf RHEL 9 5.14.0-687.38.1.el9_8
  • rtla RHEL 9 5.14.0-687.38.1.el9_8
  • libperf RHEL 9 5.14.0-687.38.1.el9_8
  • kernel-rt RHEL 9 5.14.0-687.38.1.el9_8
  • kernel-64k RHEL 9 5.14.0-687.38.1.el9_8
  • kernel-core RHEL 9 5.14.0-687.38.1.el9_8

red hat advisories RHSA-2026:59091RHSA-2026:56573RHSA-2026:55444RHSA-2026:53990RHSA-2026:53989RHSA-2026:53329

  • kernel-64kb SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS, SLE High Performance Computing 15 SP5-ESPOS 5.14.21-150500.55.182.1
  • kernel-syms SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 5.14.21-150500.55.182.1
  • kernel-source SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 5.14.21-150500.55.182.1
  • kernel-default SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +3 more 5.14.21-150500.55.182.1
  • kernel-obs-build SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 5.14.21-150500.55.182.1
  • kernel-default-base SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE Micro 5.5 +2 more 5.14.21-150500.55.182.1.150500.6.85.2
  • kernel-rt Real Time Module 15 SP7 6.4.0-150700.7.72.1
  • kernel-syms-rt Real Time Module 15 SP7 6.4.0-150700.7.72.1

suse advisories SUSE-SU-2026:3595-1SUSE-SU-2026:3810-1SUSE-SU-2026:3790-1SUSE-SU-2026:23244-1SUSE-SU-2026:23241-1SUSE-SU-2026:23194-1

  • kernel-rt openSUSE Leap 16.0 6.12.0-160000.37.1
  • dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.37.1
  • kernel-64kb openSUSE Leap 16.0 6.12.0-160000.37.1
  • kernel-syms openSUSE Leap 16.0 6.12.0-160000.37.1
  • kernel-azure openSUSE Leap 16.0 6.12.0-160000.37.1
  • kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.37.1
  • kernel-source openSUSE Leap 16.0 6.12.0-160000.37.1
  • kernel-default openSUSE Leap 16.0 6.12.0-160000.37.1

opensuse advisories openSUSE-SU-2026:21555-1openSUSE-SU-2026:10800-1

  • kernel AlmaLinux 9 5.14.0-687.38.1.el9_8
  • rv AlmaLinux 9 5.14.0-687.38.1.el9_8
  • perf AlmaLinux 9 5.14.0-687.38.1.el9_8
  • rtla AlmaLinux 9 5.14.0-687.38.1.el9_8
  • libperf AlmaLinux 9 5.14.0-687.38.1.el9_8
  • kernel-rt AlmaLinux 9 5.14.0-687.38.1.el9_8
  • kernel-64k AlmaLinux 9 5.14.0-687.38.1.el9_8
  • kernel-core AlmaLinux 9 5.14.0-687.38.1.el9_8

almalinux advisories ALSA-2026:53329ALSA-2026:50978ALSA-2026:50979

  • kernel Rocky Linux 9 5.14.0-687.38.1.el9_8
  • kernel-rt Rocky Linux 8 4.18.0-553.153.1.rt7.494.el8_10
  • kernel Rocky Linux 8 4.18.0-553.153.1.el8_10
  • kernel Rocky Linux 8 4.18.0-553.153.1.el8_10.cloud.0.1

rocky linux advisories RLSA-2026:53329RLSA-2026:50979RLSA-2026:50978RXSA-2026:50978

  • xen Alpine 3.20 4.18.5-r8
  • xen Alpine 3.21 4.19.5-r3
  • xen Alpine 3.23, Alpine 3.22 4.20.3-r3
  • xen Alpine 3.24 4.21.1-r4

alpine advisories ALPINE-CVE-2025-54518

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2025-54518 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
5mo ago

Exploit prediction

0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 4.0 7.3 CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADP 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 4.0 7.3 CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • AMD AMD EPYC™ 7002 Series Processors
  • AMD AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics
  • AMD AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics
  • AMD AMD Ryzen™ 3000 Series Desktop Processors
  • AMD AMD Ryzen™ Threadripper™ PRO 3000 WX-Series Processors
  • AMD AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics
  • AMD AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics
  • AMD AMD Ryzen™ 4000 Series Desktop Processors
  • AMD AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics
  • AMD AMD EPYC™ Embedded 7002 Series Processors
  • AMD AMD Ryzen Embedded V2000A Series Processors
  • AMD AMD Ryzen™ Embedded V2000 Series Processors
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat OpenShift Container Platform 4.12
  • Red Hat Red Hat OpenShift Container Platform 4.16
  • Red Hat Red Hat OpenShift Container Platform 4.17
  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat Red Hat OpenShift Container Platform 4.20
  • Red Hat Red Hat OpenShift Container Platform 4.21
  • Red Hat Red Hat OpenShift Container Platform 4.22
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux for NVIDIA 26
  • Red Hat Red Hat OpenShift Container Platform 4

Classification

Weakness
  • CWE-1189 Improper Isolation of Shared Resources on System-on-a-Chip (SoC)
  • CWE-1220 Insufficient Granularity of Access Control

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.