CVE-2025-52536: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-52536 is a firmware integrity vulnerability in AMD Secure Encrypted Virtualization (SEV) firmware caused by improper prevention of lock bit modification (CWE-1231). It allows a privileged local attacker to downgrade the SEV firmware to an older, potentially vulnerable version, resulting in a loss of integrity. The vulnerability affects multiple AMD EPYC server and embedded processor families, including Milan (7003), Genoa/Bergamo/Siena (8004/9004), and Turin (9005) series, as well as their embedded counterparts. It was publicly disclosed on February 10, 2026, as part of AMD Security Bulletin AMD-SB-3023. The CVSS v4.0 base score is 6.7 (Medium) (AMD Advisory).

The root cause is classified as CWE-1231 (Improper Prevention of Lock Bit Modification), meaning the SEV firmware fails to properly enforce lock bits that should prevent modification of security-critical configuration registers or firmware version controls. This allows a privileged attacker (requiring high privileges, local access) to bypass the lock mechanism and load an older, downgraded firmware version. The attack vector is local, requires no user interaction, and has no attack complexity or special attack requirements beyond high privilege. The vulnerability specifically impacts SEV-SNP (Secure Nested Paging) functionality, as indicated by AMD's SEV table, and was discovered internally by AMD (AMD Advisory).

Successful exploitation allows a privileged attacker to downgrade the SEV firmware to a prior version that may contain known vulnerabilities, undermining the integrity guarantees of AMD's confidential computing stack. This could enable persistent compromise of the SEV-SNP security boundary, potentially exposing guest VM memory confidentiality and integrity to a malicious hypervisor or host-level attacker. There is no direct confidentiality or availability impact from this specific vulnerability, but the integrity loss from firmware downgrade can serve as a stepping stone to further exploitation of older firmware flaws (AMD Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-52536. The vulnerability requires high privileges (Ring 0 / hypervisor-level access) and local access, significantly limiting the attacker pool. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. AMD identified this vulnerability internally (AMD Advisory).

AMD recommends updating to the patched Platform Initialization (PI) firmware or SEV firmware versions provided through OEM BIOS updates. Key mitigations by platform include:

• EPYC 7003 "Milan": SEV FW 1.37.1F, SPL[SEV]=0x1A (via MilanPI 1.0.0.H, released 2025-09-04; SEV FW fix released 2025-05-02)
• EPYC 8004 "Siena" / 9004 "Bergamo" / 9004 "Genoa": SEV FW 1.37.2B, SPL[SEV]=0x19 (via GenoaPI 1.0.0.G, released 2025-06-27; SEV FW fix released 2025-05-08)
• EPYC 9005 "Turin": SEV FW 1.37.3D, SPL[SEV]=0x2 (via TurinPI 1.0.0.5, released 2025-04-18)
• Embedded EPYC 7003: EmbMilanPI-SP3 v9 1.0.0.C (2025-10-31); Embedded EPYC 8004/9004: EmbGenoaPI-SP5 1.0.0.B (2025-08-04); Embedded EPYC 9005: EmbTurinPI-SP5 1.0.0.1 (2025-10-31)

Users should contact their OEM for the specific BIOS update applicable to their hardware (AMD Advisory, HPE Advisory).

AMD published Security Bulletin AMD-SB-3023 on February 10, 2026, disclosing CVE-2025-52536 alongside 20 other EPYC processor vulnerabilities. HPE issued a corresponding advisory (HPESBHF04999) for affected HPE systems. Dell also published a security update (DSA-2026-188) addressing this CVE in Dell AX systems for Azure Local. Community and researcher reaction has been limited, consistent with the vulnerability's high privilege requirement and lack of public exploit code (AMD Advisory, HPE Advisory).