USN-8665-1: AMD CPU Flaws Patched in Ubuntu Raspberry Pi Kernel — CVE-2025-54505, CVE-2025-54518 Remediation Guide

Canonical has published USN-8665-1, an Ubuntu Security Notice addressing multiple vulnerabilities in the Linux kernel build for Raspberry Pi (linux-raspi) systems. While the advisory targets the Raspberry Pi kernel package, the most significant findings are rooted in AMD processor microarchitecture, and defenders running any Ubuntu-based ARM or AMD-adjacent infrastructure should treat this advisory as a patching priority.

Three distinct issues are covered:

• CVE-2025-54505 — Some AMD processors fail to properly clear data in the floating-point divider unit during speculative execution, allowing a local attacker to leak sensitive information across privilege boundaries.
• CVE-2025-54518 — Some AMD Zen 2 processors fail to properly isolate shared resources in the operation (op) cache, enabling a local attacker to corrupt instructions executing at a higher privilege level — a privilege escalation primitive.
• An RDSEED entropy defect on certain AMD Zen 5 processors, where the RDSEED instruction may return insufficiently random values, undermining cryptographic key generation and other security-critical consumers of hardware entropy.

The common thread: these are local vulnerabilities. They are not remotely exploitable on their own — but in any environment where an attacker has achieved initial code execution (web shell, compromised service account, malicious container, insider), a local privilege escalation or information leak is exactly the capability they need to turn a low-value foothold into full root compromise. In modern intrusion chains, the local privesc is rarely the first step — it is almost always the second.

Technical Analysis

Affected Products and Platforms

• Ubuntu Linux kernel for Raspberry Pi (linux-raspi) — the package targeted by USN-8665-1
• AMD processors affected at the silicon/microcode level, specifically:
  • Certain AMD families with the floating-point divider speculative leak (CVE-2025-54505)
  • AMD Zen 2 (Rome/Matisse/Renoir era) for the op cache isolation flaw (CVE-2025-54518)
  • AMD Zen 5 parts supporting the RDSEED instruction for the entropy handling defect
• The Raspberry Pi kernel build carries these fixes because the kernel contains the shared x86 speculative-execution mitigation framework and CPU bug-workaround tables; Canonical routinely rolls CPU-related hardening into all kernel flavors, even when the silicon in question is more commonly found in server and desktop fleets.

CVE-2025-54505 — Floating-Point Divider Speculative Leak

This is a transient execution side channel in the family of Spectre-class vulnerabilities. The floating-point divider unit is a shared, non-pipelined execution resource. If the divider's internal state is not cleared when speculative execution is squashed or when context switches occur between privilege domains, an attacker-controlled process can execute carefully timed floating-point division sequences and infer residual data from a victim's operations via timing measurements.

From a defender's perspective, the key facts:

• Exploitation requirement: Local code execution on the same physical core/SMT sibling as the victim.
• Impact: Confidentiality — leakage of sensitive data, potentially including cryptographic material processed through floating-point or vectorized code paths.
• Mitigation: Kernel-side clearing of divider state (serialize or scrub the unit on context switch / privilege transition), typically delivered in combination with microcode updates.

CVE-2025-54518 — Zen 2 Op Cache Isolation Failure (Privilege Escalation)

This is the most dangerous item in the advisory. The op cache (operation cache) on Zen 2 stores decoded micro-ops for reuse. If cache entries or associated resources are not properly isolated between privilege domains, an unprivileged local attacker can influence or corrupt micro-ops that will later be consumed by code running at a higher privilege level (kernel, hypervisor, SMM-adjacent paths).

The result is instruction corruption at elevated privilege — which in practical terms is a local privilege escalation primitive. Unlike a side channel that leaks bits one at a time, this flaw can directly alter what privileged code executes.

Defensive considerations:

• Exploitation requirement: Local execution; no user interaction needed beyond attacker code running on the host.
• Impact: Integrity and availability — unauthorized privilege gain, potential kernel compromise.
• Multi-tenant risk: Shared hosting, CI/CD runners, Kubernetes worker nodes, and VDI environments are the highest-risk deployment models, because "local attacker" is a given in those architectures rather than a precondition.

Zen 5 RDSEED Entropy Defect

On certain Zen 5 processors, the RDSEED instruction — the hardware source that feeds /dev/random, getrandom(), and downstream cryptographic libraries — does not properly handle entropy, and may return values with insufficient randomness. Any security control that trusts RDSEED output (key generation, nonce generation, seeding of DRBGs) inherits that weakness. A local attacker able to influence or predict RDSEED output could degrade the strength of keys generated on the affected host.

Exploitation Status

As of this writing:

• There are no confirmed reports of in-the-wild exploitation and none of these CVEs currently appear in the CISA Known Exploited Vulnerabilities (KEV) catalog.
• These are coordinated disclosures patched through the kernel; public, weaponized PoCs have not been observed in active campaigns.
• That said, speculative-execution and cache-isolation flaws have a well-established history of rapid research-to-PoC cycles, and local privilege escalation primitives are among the most sought-after components for post-exploitation toolkits. Patch before a reliable PoC exists, not after.

Detection & Response

Direct detection of the side-channel read (CVE-2025-54505) is not practical at the telemetry level — timing attacks leave almost no log artifacts. The realistic detection strategy is twofold: (1) identify unpatched kernels in your fleet, and (2) detect the post-exploitation behavior an attacker would exhibit after using CVE-2025-54518 to gain root — unexpected privilege transitions, kernel tampering, and persistence establishment.

Sigma Rules

---
title: Linux Unexpected Privilege Escalation to Root via Sudo or SUID
description: Detects unexpected transitions to UID 0 from service or non-administrative accounts, a common artifact following local privilege escalation such as exploitation of CVE-2025-54518 on unpatched kernels.
references:
  - https://ubuntu.com/security/notices/USN-8665-1
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/01/15
status: experimental
id: 3f7a2c91-8b4e-4d5a-9c61-2e8f0a1b7d43
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'SYSCALL'
    syscall: 'setuid'
    a0: '0'
    success: 'yes'
  filter_known_admins:
    AUID|contains:
      - 'root'
  condition: selection and not filter_known_admins
falsepositives:
  - Legitimate service accounts configured to setuid for operational tasks
level: high
---
title: Linux Kernel Module Loaded by Non-Standard Process
description: Detects kernel module insertion initiated by processes outside normal system management paths, consistent with post-exploitation kernel tampering after local privilege escalation.
references:
  - https://ubuntu.com/security/notices/USN-8665-1
  - https://attack.mitre.org/techniques/T1547/006/
author: Security Arsenal
date: 2026/01/15
status: experimental
id: 9c1d5e27-4a6b-4f38-8d52-7b3e9c0a2f15
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1547.006
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/insmod'
      - '/modprobe'
      - '/finit_module'
  filter_systemd:
    ParentImage|endswith:
      - '/systemd'
      - '/init'
  condition: selection and not filter_systemd
falsepositives:
  - Administrator-driven module loading for hardware enablement
  - DKMS builds during kernel upgrades
level: medium
---
title: Direct Access to Kernel Memory or Model-Specific Register Devices
description: Detects attempts to open /dev/mem, /dev/kmem, or /dev/msr devices, which may indicate low-level CPU manipulation associated with speculative-execution research tooling or microcode-level attacks such as CVE-2025-54518 exploitation attempts.
references:
  - https://ubuntu.com/security/notices/USN-8665-1
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/01/15
status: experimental
id: 5b8e3f14-2c7d-4a96-b183-6d0f4e9c8a27
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|startswith:
      - '/dev/mem'
      - '/dev/kmem'
      - '/dev/msr'
      - '/dev/cpu/'
  condition: selection
falsepositives:
  - Hardware monitoring agents (lm-sensors, turbostat) reading MSRs
  - Performance profiling tools running under administrator control
level: medium

KQL — Microsoft Sentinel (via Syslog/CEF ingestion)

Even though this is a Linux threat, fleets forwarding syslog and auditd to Sentinel can hunt for both the vulnerable state and post-exploitation artifacts:

// Hunt 1: Identify hosts still running unpatched kernels (no reboot since update)
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has "Linux version" or ProcessName =~ "uname"
| project TimeGenerated, Computer, SyslogMessage
| order by TimeGenerated desc;

// Hunt 2: Post-exploitation artifacts — unexpected privilege escalation and module loads
union Syslog, CommonSecurityLog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any ("insmod", "finit_module", "/dev/mem", "/dev/msr", "setuid")
   or SyslogMessage has "sudo" and SyslogMessage has "COMMAND" and SyslogMessage !has_any ("apt", "systemctl restart")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by Computer asc, TimeGenerated desc;

// Hunt 3: New local account creation — common persistence step after privesc
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ("useradd", "new user", "adduser")
| project TimeGenerated, Computer, HostIP, SyslogMessage
| order by TimeGenerated desc

Velociraptor VQL

Use this hunt to inventory kernel patch state and look for low-level device access across your Linux endpoints:

-- Inventory kernel versions and check for MSR/mem device access artifacts
SELECT {
    SELECT Version FROM info()
} AS KernelInfo,
    Pid,
    Name,
    CommandLine,
    Username,
    Exe
FROM pslist()
WHERE CommandLine =~ 'insmod|modprobe|/dev/mem|/dev/msr|msr-tools|rdmsr|wrmsr'
   OR Exe =~ '/dev/(mem|msr)'

-- Companion: enumerate loaded out-of-tree kernel modules for tampering review
SELECT FullPath, Mtime, Size
FROM glob(globs='/sys/module/*/holders', accessor='file')
ORDER BY Mtime DESC

Remediation & Verification Script

#!/bin/bash
# USN-8665-1 remediation and verification — Ubuntu (linux-raspi and related flavors)
# Run as root. Test in staging before fleet-wide deployment.

set -euo pipefail

echo "[*] Current kernel: $(uname -r)"
echo "[*] CPU: $(grep -m1 'model name' /proc/cpuinfo 2>/dev/null || echo 'ARM SoC')"

# 1. Refresh package metadata and apply the USN-8665-1 kernel updates
apt-get update
apt-get install -y --only-upgrade linux-image-raspi linux-headers-raspi linux-raspi \
  2>/dev/null || apt-get dist-upgrade -y

# 2. Apply AMD microcode updates where applicable (amd64 hosts)
if grep -qi 'authenticamd' /proc/cpuinfo 2>/dev/null; then
  echo "[+] AMD CPU detected — ensuring amd64-microcode is installed"
  apt-get install -y amd64-microcode
fi

# 3. Verify the new kernel is staged
NEW_KERNEL=$(ls -1 /boot/vmlinuz-* 2>/dev/null | sort -V | tail -1)
echo "[+] Staged kernel image: ${NEW_KERNEL}"

# 4. Check whether a reboot is required
if [ -f /var/run/reboot-required ]; then
  echo "[!] REBOOT REQUIRED — kernel mitigations for CVE-2025-54505/CVE-2025-54518 only take effect after boot into the patched kernel"
  cat /var/run/reboot-required.pkgs 2>/dev/null || true
fi

# 5. Post-reboot verification: confirm active mitigations are reported
echo "[*] Vulnerability exposure state (run again AFTER reboot):"
for f in /sys/devices/system/cpu/vulnerabilities/*; do
  printf '%s: %s\n' "$(basename "$f")" "$(cat "$f")"
done

# 6. Audit for suspicious low-level tooling (post-exploitation hygiene check)
echo "[*] Checking for MSR/mem access tooling:"
command -v rdmsr wrmsr 2>/dev/null && echo "[!] msr-tools present — validate business need" || echo "[+] No msr-tools installed"
lsmod | grep -v -E '^(Module|overlay|br_netfilter)' || true

echo "[+] Done. Reboot into the patched kernel to activate mitigations."

Remediation

1. Apply USN-8665-1 immediately on all affected Ubuntu systems. Run sudo apt update && sudo apt dist-upgrade (or target the linux-raspi packages directly on Raspberry Pi deployments). The mitigations are delivered through the patched kernel; they are not active until you reboot into the new kernel. Track reboot debt explicitly — an installed-but-not-booted kernel provides zero protection.

2. Deploy AMD microcode updates on amd64 hosts. Ensure the amd64-microcode package is installed and current. Kernel-level software mitigations and microcode work in tandem for speculative-execution and cache-isolation classes of flaws; deploying only one leaves residual exposure.

3. Prioritize multi-tenant and shared-compute environments. CI/CD runners, container hosts, hypervisors, and VDI nodes are where "local attacker" is the default assumption. CVE-2025-54518 is a privesc primitive — in those environments it converts any workload compromise into a host compromise. Patch these first.

4. Treat RDSEED-dependent key generation on Zen 5 hosts as suspect until patched. For high-value key material generated on affected Zen 5 systems before patching, evaluate whether re-keying is warranted based on your threat model. Post-patch, verify that cryptographic services are consuming entropy through the kernel's getrandom() path, which mixes sources, rather than raw RDSEED calls.

5. Verify mitigations after reboot. Check /sys/devices/system/cpu/vulnerabilities/ on amd64 hosts and confirm the running kernel (uname -r) matches the patched version delivered by the USN. Feed kernel version inventory into your vulnerability management platform and close the loop.

6. Monitor for the post-exploitation artifacts detailed above — unexpected setuid-to-root transitions, out-of-band kernel module loads, and access to /dev/mem or /dev/msr — since these flaws are invisible at the moment of exploitation but highly visible in what an attacker does with the privileges gained.

References: USN-8665-1 — Ubuntu Security Notices. No CISA KEV entries or in-the-wild exploitation have been reported for these CVEs as of publication; that window will not stay open indefinitely.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub