CVE-2025-54505: AMD Speculative Execution Vulnerability in Linux Kernel (USN-8575-3)

Ubuntu Security Notice USN-8575-3 details a critical set of patches for the Linux kernel, most notably addressing a new speculative execution vulnerability tracked as CVE-2025-54505. This flaw affects specific AMD processors and allows a local attacker to infer sensitive data from the kernel memory via the floating point divider unit.

While the update also resolves an older NTFS out-of-bounds read issue (CVE-2023-45896), the primary concern for defenders in 2026 is the hardware-level isolation failure in AMD chips. Speculative execution side-channel attacks remain a persistent threat to hypervisor and host isolation. Immediate patching is required to maintain the confidentiality of kernel memory structures and cryptographic material.

Technical Analysis

Affected Products & Versions

• Platform: Ubuntu Linux (refer to USN-8575-3 for specific release versions)
• Hardware: Specific AMD processors (Zen and Zen 2 architectures implicated in the advisory context)

CVE Identifier

• CVE-2025-54505: Improper data clearing in the floating point divider unit during speculative execution.

Mechanism of Attack

• Vector: Local access required.
• Attack Chain: An attacker with local access (e.g., a malicious tenant in a cloud environment or a compromised low-privilege user) executes a specially crafted sequence of instructions. The AMD floating point divider unit retains data from previous speculative operations. By observing the microarchitectural state, the attacker can reconstruct this data, effectively bypassing memory isolation boundaries.
• Impact: Disclosure of sensitive information, including kernel memory pointers and potentially encryption keys.

Exploitation Status

• Currently assessed as a theoretical capability leveraging known side-channel techniques, but the complexity of exploitation is low once a PoC is developed. Given the prevalence of AMD processors in enterprise infrastructure, the risk profile is high.

Detection & Response

Detecting speculative execution attacks in real-time is notoriously difficult, as they do not generate traditional process crashes or explicit log entries. However, defenders can hunt for the precursors to exploitation, such as the mounting of untrusted filesystems (addressed in the same USN) or suspicious local system enumeration.

Sigma Rules

---
title: Potential Linux Kernel Info Disclosure via NTFS Mount
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects attempts to mount NTFS filesystems, which may relate to exploitation of vulnerabilities in kernel file system implementations like those referenced in USN-8575-3.
references:
  - https://ubuntu.com/security/notices/USN-8575-3
author: Security Arsenal
date: 2026/02/18
tags:
  - attack.initial_access
  - attack.t1200
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - 'mount -t ntfs'
      - 'mount.ntfs'
      - 'ntfs-3g'
  condition: selection
falsepositives:
  - Legitimate administrative access of Windows dual-boot partitions or external drives
level: low
---
title: Linux Kernel Memory Reconnaissance Activity
id: b2c3d4e5-6789-01ab-cdef-2345678901bc
status: experimental
description: Detects command-line activity often associated with probing kernel memory structures, a common step in validating speculative execution exploits.
references:
  - https://attack.mitre.org/techniques/T1082/
author: Security Arsenal
date: 2026/02/18
tags:
  - attack.discovery
  - attack.t1082
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - '/proc/kallsyms'
      - '/dev/mem'
      - '/dev/kmem'
      - 'dmesg'
  condition: selection
falsepositives:
  - System administration and debugging activities
level: medium

KQL (Microsoft Sentinel / Defender)

// Hunt for NTFS mount attempts related to USN-8575-3
Syslog
| where ProcessName contains "mount"
| where SyslogMessage has "ntfs"
| project TimeGenerated, HostName, ProcessName, SyslogMessage
| extend IoC = "NTFS_Mount_Attempt"

// Check for successful kernel package updates on Ubuntu
Syslog
| where ProcessName has_any ("apt", "unattended-upgrades")
| where SyslogMessage has "linux-image"
| where SyslogMessage has "installed"
| project TimeGenerated, HostName, SyslogMessage
| sort by TimeGenerated desc

Velociraptor VQL

-- Hunt for processes reading sensitive kernel memory interfaces
SELECT Pid, Name, CommandLine, Exe
FROM pslist()
WHERE CommandLine =~ 'kallsyms'
   OR CommandLine =~ '/dev/mem'
   OR Name =~ 'dmesg'

-- Verify installed kernel version to ensure patch compliance
SELECT KernelVersion, Fqdn, OS.Release
FROM info()

Remediation Script (Bash)

#!/bin/bash
# Remediation for USN-8575-3: CVE-2025-54505
# Updates the Linux kernel to the patched version

echo "[+] Starting remediation for USN-8575-3..."

# Update package lists
echo "[+] Updating package lists..."
sudo apt-get update -y

# Upgrade the kernel specifically (or full upgrade)
echo "[+] Installing kernel security updates..."
sudo apt-get install -y linux-image-generic

# Check if a reboot is required
if [ -f /var/run/reboot-required ]; then
    echo "[!] System reboot required to apply kernel changes."
    cat /var/run/reboot-required.pkgs
else
    echo "[+] No immediate reboot required (but recommended for kernel updates)."
fi

echo "[+] Remediation script complete."

Remediation

1. Patch Immediately: Apply the updates provided in USN-8575-3. Standard apt-get update && apt-get upgrade procedures will deploy the fixed kernel versions.
2. Reboot Required: Kernel updates require a system reboot to load the new vulnerable-free kernel.
3. Verify: After rebooting, use uname -r to confirm the active kernel version matches the patched version listed in the Ubuntu advisory.
4. Context: While this advisory also addresses an NTFS issue (CVE-2023-45896), the priority driver for 2026 is the AMD speculative execution fix (CVE-2025-54505). Ensure cloud instances and bare-metal AMD hosts are prioritized.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub