AMD Zen 1-Zen 5 - branch predictor isolation between guest and userspace hypervisor (AMD-SB-7046): Insufficient

UnscoredCVE-2025-40300Kernel, userspace & hypervisorVMSCAPEcurated

Impact

Insufficient branch-predictor isolation between a guest VM and the **userspace** hypervisor process - QEMU - lets a malicious guest train the predictor and then steer speculation inside the VMM that manages it. The VMM has the guest's memory mapped, so this is a Spectre-class read of confidential guest state from a process the guest can influence. AMD rates it High and, unusually, it spans **Zen 1 through Zen 5** - there is no 'we are on new silicon' escape from this one.

Who can reach it

From inside a guest VM. Tenant-reachable, no host privilege required. Affects every AMD generation currently in datacenter service.

What to do

Fixed in the Linux kernel by issuing a conditional IBPB after every VMexit before returning to userspace. Take the distro kernel update and reboot the host - no firmware, BIOS or microcode step, which makes it one of the cheaper fixes to deploy. **Expect a real performance cost**: the kernel commit itself notes the IBPB duplicates the context-switch IBPB and that workloads switching frequently between hypervisor and userspace absorb the most overhead. On a virtualised GPU fleet with heavy device emulation, benchmark before and after rather than assuming it is free.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-40300 https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7046.html

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.