Junglewise Threat Intelligence

CVE-2026-31628: Linux Kernel information disclosure in AMD Zen1 hardware divider

CVE-2026-31628 · Severity: medium · CVSS 5.5 · Published 2026-04-24

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A hardware flaw in AMD Zen1 processors, used in various computing systems and industrial controllers, could allow sensitive data to leak between different programs or users. The processor's hardware divider may fail to clear data from previous calculations, potentially allowing an attacker to observe information they should not have access to. This issue affects the Linux kernel and specific Siemens industrial CPUs that utilize these processors.

Technical details

This vulnerability stems from a hardware flaw in the AMD Zen1 architecture's floating-point hardware divider (FPDSS). Under specific conditions, the divider can retain partial results from previous operations, which can then be observed by a separate attacker-controlled thread. The fix involves setting a 'chicken bit' (MSR_AMD64_FP_CFG_ZEN1_DENORM_FIX_BIT) in the Model Specific Register (MSR) to change hardware behavior and prevent this leakage. The vulnerability is addressed in the Linux kernel via updates to arch/x86/kernel/cpu/amd.c and arch/x86/include/asm/msr-index.h. Local access is required for exploitation.

Affected products

  • Linux Linux Kernel Zen1 architectures; various stable branches patched
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-04-07: patched: Initial patch authored by AMD for Linux kernel
  • 2026-04-24: disclosed: CVE published

References

Related threats