Intel reference platforms (Seamless Firmware Updates): A race condition in the seamless firmware update mechanism lets

Impact

A race condition in the seamless firmware update mechanism lets a privileged local user cause denial of service. Seamless update is the feature that is supposed to let you patch platform firmware without a reboot - a bug that turns it into an outage undermines the whole reason operators enable it.

Who can reach it

Privileged local access on the host.

What to do

Platform firmware update from the OEM. Ironically this one does need a conventional drain and reboot to install, since the seamless path is what is broken.

References

Related entries

• Dell SmartFabric OS10 (hard-coded password): A hard-coded password in SmartFabric OS10 10.5.5.4-10.5.5.10 and 10.5.6.xCVE-2024-39585 · Dell SmartFabric OS10 (hard-coded password)High
• Insyde InsydeH2O (VariableRuntimeDxe, SecureBootHandler): The Secure Boot variable handler bounds-checks incoming dataCVE-2024-52880 · Insyde InsydeH2O (VariableRuntimeDxe, SecureBootHandler)High
• Intel Xeon 6 with TDX (protected memory range handling): Improper handling of overlap between protected memory rangesCVE-2025-22889 · Intel Xeon 6 with TDX (protected memory range handling)High
• IBM Power Systems Firmware: BMC/FSP root can read and disrupt host processor state across all partitionsCVE-2026-17063 · IBM Power Systems Firmware (BMC/FSP-to-host interface, processor state)High
• TPM 2.0 reference code: leak lets a privileged local user obtain a CA credential for a falsified TPM keyCVE-2026-6726 · TCG TPM 2.0 reference code (attestation credential handling, TCG VRT0010)High
• Linux kernel RDS RDMA path net/rds/rdma.c - rds_rdma_pages: The page-count arithmetic for an RDS RDMA scatter-gatherCVE-2010-3865 · Linux kernel RDS RDMA path net/rds/rdma.c - rds_rdma_pagesHigh