AMD Zen 2 CVE-2025-54518

Apply the vendor-released firmware/microcode update for your specific platform per AMD-SB-7052 (https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-7052.html): update system BIOS/UEFI to the fixed AGESA image for your part, for example ComboAM4v2 1.2.0.10 or ComboAM4PI 1.0.0.10 for Ryzen 3000/4000/5000 desktop, CezannePI-FP6_1.0.1.1d for Ryzen 5000/7030 mobile, RenoirPI-FP6_1.0.0.Ed for Ryzen 4000 mobile, MendocinoPI-FT6_1.0.0.7f for Ryzen 7020, ChagallWSPI-sWRX8-1.0.0.D or CastlePeakWSPI-sWRX8 1.0.0.I for Threadripper PRO 3000 WX, and EmbeddedV2KAPI-FP6 1.0.0.A / EmbeddedPI-FP6_1.0.0.D for embedded V2000A/V2000; for EPYC 7002 and EPYC Embedded 7002 the fix is delivered via OS kernel microcode/mitigation, so apply the corresponding OS updates (Ubuntu USN-8566-1/8567-1/8568-1, and Red Hat's advisory at https://access.redhat.com/security/cve/CVE-2025-54518). Virtualization hosts should also apply the Xen mitigation (http://xenbits.xen.org/xsa/advisory-490.html). Because this is a hardware isolation defect with no true configuration workaround, the primary compensating control until firmware can be staged is to restrict local/low-privilege code execution on affected hosts - for multi-tenant systems, limit untrusted guest or user workloads on Zen 2 hardware, accepting the trade-off of reduced consolidation density; firmware updates themselves may carry a minor performance impact.