CVE-2025-54505: AMD Speculative Execution Leak Patched in Ubuntu Raspberry Pi Kernel — USN-8668-2 Remediation Guide

Canonical published USN-8668-2, an updated security notice covering the Linux kernel build for Raspberry Pi platforms on Ubuntu. The notice carries forward fixes for three distinct issues, and one of them deserves immediate attention from any defender running mixed AMD/Raspberry Pi Ubuntu estates: CVE-2025-54505, a speculative execution flaw in AMD processors where the floating-point divider unit fails to properly clear data between operations, allowing a local attacker to recover sensitive information from other contexts on the same core.

The notice also addresses:

• CVE-2023-45896 — an out-of-bounds read in the kernel's NTFS implementation caused by improper validation of file name length. An attacker can craft a malicious NTFS image that, once mounted, leaks kernel memory. This is an older bug, but its inclusion in a 2026 Raspberry Pi kernel rebuild means embedded and edge fleets that rarely reboot are only now receiving the fix — treat it as a live patching-gap issue, not history.
• An AMD Zen 2 operation cache isolation defect — shared op-cache resources are not properly isolated, and a local attacker can potentially corrupt instructions executing at a higher privilege level. That is privilege escalation via microarchitectural instruction corruption, which is about as bad as local attacks get.

Why this matters operationally: Raspberry Pi kernels ship into IoT gateways, kiosks, industrial sensors, and edge collectors that sit outside normal patch cadences. If your vulnerability scanner doesn't enumerate ARM kernel packages on these devices, USN-8668-2 will never show up on a dashboard — but the exposure is real.

Technical Analysis

Affected Products and Platforms

• Ubuntu Linux kernel, Raspberry Pi (linux-raspi) builds covered by USN-8668-2 and its parent notice USN-8668-1
• Ubuntu LTS releases running the raspi kernel flavor on ARM64 (Pi 3/4/5 class hardware)
• The CPU-side issues (CVE-2025-54505 and the Zen 2 op-cache flaw) are mitigated at the kernel/microcode level and affect systems running vulnerable AMD silicon — relevant where the parent notice's kernel code base is shared or where AMD hosts run the same kernel series

CVE Breakdown

How Exploitation Works (Defender's View)

CVE-2025-54505 follows the transient-execution pattern defenders know from the Spectre/Meltdown lineage: an unprivileged local process issues floating-point divide operations and observes residual data left in the divider unit by a prior, higher-trust context on the same SMT sibling. No memory corruption is required — just local code execution and timing. This makes multi-tenant hosts, CI runners, container hosts, and shared build systems the highest-risk environments. The kernel fix serializes or flushes the affected unit state across context switches.

CVE-2023-45896 requires the victim (or an automated process) to mount an attacker-crafted NTFS image. Realistic delivery paths: USB drop/present attacks against kiosks and Pi-based field devices, helpdesk staff mounting "evidence" images, or automated ingestion pipelines that loop-mount user-supplied disk images. Once mounted, ordinary filesystem operations on malformed name-length fields trigger an out-of-bounds read that can disclose kernel memory contents.

The Zen 2 op-cache issue is the sleeper in this notice. Corrupting instructions scheduled for execution at a higher privilege level turns a local foothold into ring-0 influence. It requires local code execution, but in a post-ransomware reality where initial access is commodity, local-to-kernel escalation chains are exactly what operators buy on the market.

Exploitation Status

As of this writing, none of the CVEs in USN-8668-2 are listed in the CISA Known Exploited Vulnerabilities catalog, and there is no confirmed in-the-wild exploitation campaign. However, transient-execution research PoCs for AMD platforms historically appear quickly after disclosure, and NTFS image-mount bugs have a long track record of abuse in targeted physical-access scenarios. Treat as pre-weaponization: patch before PoCs mature.

Detection & Response

Detection here is less about catching the exploit primitive (speculative leaks are effectively silent) and more about catching the preconditions: unauthorized mounting of disk images, unexpected NTFS driver activity, and unpatched kernel versions persisting in the fleet.

Sigma Rules

---
title: Linux NTFS Image Mount via Loop Device
description: Detects loop-mounting of NTFS filesystem images, a delivery vector for CVE-2023-45896 malicious NTFS images that leak kernel memory via out-of-bounds reads on malformed file name lengths.
references:
  - https://ubuntu.com/security/notices/USN-8668-2
author: Security Arsenal
date: 2026/01/15
status: experimental
logsource:
  product: linux
  category: process_creation
detection:
  selection_mount:
    Image|endswith:
      - '/mount'
      - '/mount.ntfs'
      - '/mount.ntfs-3g'
    CommandLine|contains:
      - 'ntfs'
  selection_loop:
    CommandLine|contains:
      - '-o loop'
      - 'loop,'
      - '/dev/loop'
  condition: selection_mount and selection_loop
falsepositives:
  - Forensic imaging workstations
  - Legitimate data-recovery operations
level: high
---
title: NTFS Kernel Module Load on Non-Standard Host
description: Detects loading of the ntfs3 kernel module, which expands attack surface for CVE-2023-45896. Unexpected ntfs3 loads on servers, edge, or Raspberry Pi devices warrant investigation.
references:
  - https://ubuntu.com/security/notices/USN-8668-2
author: Security Arsenal
date: 2026/01/15
status: experimental
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith:
      - '/modprobe'
      - '/insmod'
    CommandLine|contains:
      - 'ntfs3'
      - 'ntfs'
falsepositives:
  - Administrators mounting NTFS volumes for maintenance
  - Desktop systems with NTFS dual-boot partitions
level: medium
---
title: Speculative Execution Side-Channel Tooling Indicators
description: Detects process behavior consistent with transient-execution side-channel research tooling (rapid cache-timing loops reading /sys vulnerability files or executing rdtsc-heavy binaries) that may indicate CVE-2025-54505 PoC testing on AMD hosts.
references:
  - https://ubuntu.com/security/notices/USN-8668-2
author: Security Arsenal
date: 2026/01/15
status: experimental
logsource:
  product: linux
  category: file_event
detection:
  selection:
    TargetFilename|startswith: '/sys/devices/system/cpu/vulnerabilities/'
falsepositives:
  - Vulnerability scanners and compliance agents enumerating CPU mitigations
  - Configuration management (Ansible, Chef) fact gathering
level: low

KQL (Microsoft Sentinel / Defender)

Hunt for NTFS image mounting and kernel version exposure across Linux systems ingested via Syslog/CEF:

// Hunt: NTFS mounts and modprobe activity on Linux estate (USN-8668-2 / CVE-2023-45896)
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName in~ ("mount", "mount.ntfs", "mount.ntfs-3g", "modprobe", "insmod", "udisksd")
| where SyslogMessage has_any ("ntfs", "ntfs3", "loop")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP
| order by TimeGenerated desc
;
// Fleet exposure: identify raspi kernels below patched versions
Heartbeat
| where TimeGenerated > ago(1d)
| where OSType == "Linux"
| summarize arg_max(TimeGenerated, *) by Computer
| join kind=leftouter (
    Syslog
    | where TimeGenerated > ago(1d)
    | where SyslogMessage has "Linux version"
    | project Computer, SyslogMessage
) on Computer
| project Computer, TimeGenerated, SyslogMessage
;
// AMD hosts potentially exposed to CVE-2025-54505 (Zen family enumeration)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("lscpu", "cat") and ProcessCommandLine has_any ("model name", "cpuinfo")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessAccountName

Velociraptor VQL

-- USN-8668-2 exposure hunt: enumerate kernel version and recent NTFS mounts on Linux endpoints
SELECT {
    SELECT Version FROM stat(filename='/proc/version')
} AS KernelVersion,
{
    SELECT Data FROM stat(filename='/sys/devices/system/cpu/vulnerabilities/spectre_v2')
} AS SpeculativeMitigation,
Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'ntfs|ntfs3|mount.*loop'
   OR Exe =~ '/mount|/modprobe'

Remediation

#!/bin/bash
# USN-8668-2 remediation & verification - Ubuntu (raspi and generic kernels)
set -e

echo "=== Current kernel ==="
uname -r

echo "=== Refreshing package metadata and applying kernel security updates ==="
sudo apt-get update
sudo apt-get install --only-upgrade -y linux-image-raspi linux-headers-raspi linux-raspi 2>/dev/null \
  || sudo apt-get dist-upgrade -y

echo "=== Checking for pending reboot / newer kernel on disk ==="
if [ -f /var/run/reboot-required ]; then
  echo "[!] REBOOT REQUIRED: kernel update staged. Schedule reboot of this device."
  cat /var/run/reboot-required.pkgs 2>/dev/null
fi

echo "=== Verifying CVE status via Ubuntu Security API tooling ==="
# pro security-status requires ubuntu-advantage-tools (default on supported releases)
sudo pro security-status --format json 2>/dev/null | grep -iE "45896|54505" \
  || echo "Run 'pro security-status' manually to confirm CVE-2025-54505 / CVE-2023-45896 show as fixed."

echo "=== Hardening: blacklist ntfs3 where NTFS mounting is not required ==="
if ! grep -q "ntfs" /etc/modprobe.d/blacklist-ntfs.conf 2>/dev/null; then
  printf 'blacklist ntfs3\nblacklist ntfs\n' | sudo tee /etc/modprobe.d/blacklist-ntfs.conf
  echo "[+] ntfs/ntfs3 blacklisted. Devices that legitimately mount NTFS must be excluded."
fi

echo "=== Confirm CPU vulnerability mitigations are active (AMD hosts) ==="
grep -r . /sys/devices/system/cpu/vulnerabilities/ 2>/dev/null

echo "=== Done. Reboot into the patched kernel to complete remediation. ==="

Remediation Checklist

1. Patch immediately: Apply USN-8668-2 via apt-get dist-upgrade (or the targeted raspi kernel packages above) on all Ubuntu Raspberry Pi devices and any AMD hosts on the affected kernel series. A reboot is mandatory — the running kernel remains vulnerable until then. Track reboot completion as a patch metric, not just package installation.
2. Enumerate your shadow Pi fleet: Raspberry Pi devices running Ubuntu are frequently absent from CMDBs. Use network discovery (SSH banners, MAC OUI B8:27:EB / DC:A6:32 / E4:5F:01 ranges) to find unmanaged Pi endpoints before attackers do.
3. Reduce NTFS attack surface: Blacklist ntfs3/ntfs kernel modules on servers, kiosks, and edge devices that have no business mounting NTFS. Disable automounting (udisks2, autorun equivalents) on exposed kiosk/field hardware to blunt malicious-image delivery for CVE-2023-45896.
4. Verify AMD mitigations: Confirm /sys/devices/system/cpu/vulnerabilities/* shows mitigations active and check AMD's security bulletin page for any accompanying microcode (AGESA) updates — kernel-only fixes may need a firmware companion for full coverage of CVE-2025-54505.
5. Prioritize multi-tenant AMD hosts: CI/CD runners, container hosts, VDI, and shared compute running Zen-family CPUs are the highest-impact targets for the speculative leak — patch these first.
6. Monitor KEV: None of these CVEs are in CISA KEV today; set a watch on the KEV catalog and the USN-8668-2 notice for status changes.

The broader lesson: a Raspberry Pi kernel notice carrying AMD CPU fixes and a 2023 NTFS bug is a reminder that edge and embedded kernels drift silently. If your patch program only watches servers and workstations, your most exposed devices are your least patched ones.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub