CVE-2025-29943: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-29943, dubbed StackWarp, is a write-what-where condition (CWE-123) in AMD CPUs that allows an admin-privileged attacker (e.g., a malicious hypervisor) to modify CPU pipeline configuration by flipping an undocumented MSR bit, potentially corrupting the stack pointer inside an SEV-SNP guest VM. It affects AMD EPYC processors across multiple generations (Milan, Genoa, Genoa-X, Bergamo, Siena, Turin, Turin Dense) as well as several AMD EPYC Embedded processor lines; earlier generations (Naples, Rome, EPYC 4004) are not affected. The vulnerability was initially published on January 15–16, 2026. AMD assigned a CVSS v3.1 score of 3.2 (Low) and a CVSS v4.0 score of 4.6 (Medium) (AMD Advisory, NVD).

The root cause is improper access control (CWE-123: Write-what-where Condition) within AMD CPUs that fails to prevent a hypervisor from setting an internal CPU configuration bit via an undocumented Model-Specific Register (MSR). By flipping this bit, a malicious hypervisor can manipulate the CPU pipeline configuration on a sibling SMT (Simultaneous Multithreading) thread, causing stack pointer corruption inside an SEV-SNP (Secure Encrypted Virtualization – Secure Nested Paging) guest. Exploitation requires local access with administrative/hypervisor-level privileges — it cannot be triggered remotely or by an unprivileged user. The attack was researched by Ruiyi Zhang, Tristan Hornetz, Daniel Weber, Fabian Thomas, Lukas Gerlach, and Michael Schwarz of CISPA, and Youheng Lü of SCHUTZWERK GmbH, with a full academic paper published at StackWarp USENIX and a PoC repository available at GitHub PoC (AMD Advisory, The Register).

Successful exploitation undermines the integrity guarantees of AMD SEV-SNP, a technology designed to protect confidential virtual machines from a malicious or compromised hypervisor. An attacker with hypervisor-level (admin) access can corrupt the stack pointer of an SEV-SNP guest, potentially leading to guest VM instability, denial of service, or full guest VM compromise — effectively breaking the confidential computing trust boundary. While confidentiality and availability impacts are rated as none by AMD's CVSS scoring, the integrity impact on the guest VM is significant in cloud and multi-tenant environments where SEV-SNP is relied upon to isolate sensitive workloads from untrusted infrastructure operators (AMD Advisory, The Hacker News).

A proof-of-concept exploit is publicly available on GitHub (GitHub PoC), and an additional PoC was published at fevar54's repo. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is very low at approximately 0.013%, reflecting the high privilege requirement (hypervisor/admin access) that significantly limits the attacker population. No threat actor attribution has been reported (Feedly, AMD Advisory).

1. Gain hypervisor-level access: The attacker must already have administrative or hypervisor-level privileges on a host system running an affected AMD EPYC processor (Milan, Genoa, Bergamo, Siena, or Turin generation) with SEV-SNP guests active.
2. Identify the undocumented MSR: Using the StackWarp research findings, identify the specific undocumented Model-Specific Register (MSR) bit that controls the CPU pipeline configuration on the target processor.
3. Flip the MSR bit: Execute a privileged MSR write instruction (e.g., wrmsr) from the hypervisor context to set the internal configuration bit, targeting the sibling SMT thread of the SEV-SNP guest.
4. Trigger CPU pipeline misconfiguration: The flipped bit causes the CPU pipeline to operate in an unexpected configuration, creating a write-what-where condition that affects the sibling SMT thread's execution context.
5. Corrupt the guest stack pointer: The misconfigured pipeline results in corruption of the stack pointer (RSP) inside the SEV-SNP guest VM running on the sibling SMT thread, bypassing SEV-SNP's memory isolation guarantees.
6. Achieve guest VM compromise: Leverage the corrupted stack pointer to redirect guest execution flow, cause a crash (DoS), or escalate to full guest VM compromise, effectively breaking the confidential computing boundary (AMD Advisory, StackWarp Paper).

• Logs: Unexpected MSR write operations logged at the hypervisor level targeting undocumented registers; guest VM crash logs or kernel panics within SEV-SNP guests indicating stack corruption (e.g., stack smashing detected, general protection faults).
• Process/VM Behavior: SEV-SNP guest VMs exhibiting unexpected crashes, reboots, or instability without apparent cause; guest VMs failing attestation checks due to unexpected TCB (Trusted Computing Base) values.
• Attestation: SEV-SNP attestation reports showing microcode TCB values below the patched thresholds (e.g., Milan TCB[MICROCODE] < 0xDE, Genoa TCB[MICROCODE] < 0x56, Turin TCB[MICROCODE] < 0x51) may indicate unpatched systems susceptible to exploitation (AMD Advisory).

AMD has released microcode (µcode) and Platform Initialization (PI) firmware/AGESA updates to address this vulnerability. Users should contact their OEM for BIOS updates incorporating the fixed firmware. Key patched versions include:

• AMD EPYC 7003 (Milan/Milan-X): µcode Milan B1: 0x0A0011DE, Milan-X: 0x0A001247; or Milan PI 1.0.0.H (AGESA release 2025-09-04)
• AMD EPYC 9004 (Genoa/Genoa-X/Bergamo): µcode Genoa: 0x0A101156/0x0A101251, Bergamo: 0x0AA0021B; or Genoa PI 1.0.0.H (AGESA release 2025-12-15)
• AMD EPYC 9005 (Turin/Turin Dense): µcode Turin C1: 0x0B002151, Turin Dense B0: 0x0B10104E; or Turin PI 1.0.0.6 (AGESA release 2025-06-30)

As interim mitigations: restrict administrative access to hypervisor hosts, enforce least privilege for admin accounts, and segment sensitive SEV-SNP workloads away from systems with untrusted administrators. SMT (Hyper-Threading) disabling may reduce exposure but is not officially recommended by AMD as a workaround (AMD Advisory).

The vulnerability received notable coverage from security media under the name StackWarp, with The Register, The Hacker News, and CyberKendra publishing detailed articles about the flaw's implications for AMD SEV-SNP confidential computing (The Register, The Hacker News). The CISPA research team published a full academic paper and presented findings, with the Eclypsium podcast also covering the vulnerability alongside other firmware security topics (Eclypsium Podcast). Community discussion on Mastodon/infosec.exchange noted the significance of the attack for cloud confidential computing trust models. HPE issued a vendor advisory (HPESC HPESBHF04991) for affected server products (HPE Advisory). AMD characterized the severity as Low/Medium, which some researchers noted may understate the real-world impact in multi-tenant cloud environments where SEV-SNP is a primary security boundary.