Executive brief
A hardware issue in AMD Zen 5 processors affects the reliability of the RDSEED instruction, which is used by the operating system to generate secure random numbers. On affected systems, the processor may incorrectly return a value of zero while falsely claiming the operation was successful. This can weaken cryptographic protections and security features that rely on high-quality randomness, potentially allowing attackers to predict sensitive data.
Technical details
A hardware vulnerability in AMD Zen 5 processors (AMD-SB-7055) causes the 16-bit and 32-bit variants of the RDSEED instruction to return 0 with a success flag (CF=1) at an unexpected rate. This failure in the hardware random number generator (TRNG) can lead to predictable cryptographic keys or initialization vectors. The Linux kernel fix implements a microcode revision check; if the processor is running a vulnerable microcode version, the kernel will disable the RDSEED CPUID bit and clear the feature flag to prevent software from relying on the broken instruction. The issue is reachable by local users executing code that utilizes these instructions or by the kernel itself during entropy seeding.
Affected products
- Linux Linux Kernel 6.8 to 6.12.57, 6.17.7
Timeline
- 2025-10-20: patched: Initial fix authored by Gregory Price
- 2025-12-16: advisory: CVE-2025-68313 published