AMD NBIO register lock bits - System Management Network access: NBIO registers that should be locked after boot are

Impact

NBIO registers that should be locked after boot are not, so a local admin-privileged attacker gets arbitrary access to the System Management Network - the internal bus that reaches the ASP and the SMU. From SMN access the attacker executes code in the AMD Secure Processor itself, which collapses both confidentiality and integrity for every SEV-SNP guest on the machine. At 8.5 this is the most severe ASP-reachable issue in the current batch.

Who can reach it

Local, host administrator. Exactly the threat model SEV-SNP claims to defend against, which is what makes it serious rather than routine.

What to do

Fixed in AMD reference firmware (AGESA / SEV firmware) and delivered to you only as an OEM SBIOS/BIOS package - Dell, HPE, Supermicro, Lenovo, Gigabyte and the ODMs each rebuild and requalify AMD's AGESA drop before it ships. **Expect months, not weeks**: AMD publishes the bulletin, the OEM ships BIOS somewhere between one and six months later, and for platforms past their support window it may never arrive at all. Applying it is a full node power cycle with the host drained - not a driver reload, not a live patch. Track it as a firmware campaign per server SKU, not per kernel version, and verify afterwards by reading back the SMU/PSP firmware version rather than trusting the BIOS revision string. Because this sits inside the SEV-SNP trust boundary, the update also moves the platform's reported TCB version: after patching you must refresh VCEK certificates from AMD's KDS and update whatever attestation policy your tenants (or your own confidential-VM control plane) pin against, or every guest launch will start failing validation. Treat any confidential-computing SLA you offer as void on unpatched nodes: the host operator - or anyone who compromises the host operator's tooling - can reach guest memory.

References

Related entries

• Pure Storage FlashBlade logging: Sensitive material ends up in FlashBlade logs under certain conditions, and the scoredCVE-2026-0207 · Pure Storage FlashBlade loggingHigh
• GitLab package registry: authenticated path traversal that can lead to remote code executionCVE-2026-10053 · GitLab CE/EE package registryHigh
• GitLab: developer-role user can run pipelines on a protected branch without push rightsCVE-2026-15423 · GitLab CE/EE (CI/CD pipeline reference authorization)High
• GitLab EE: authenticated user can attribute AI usage to another namespaceCVE-2026-19228 · GitLab EE (AI feature usage attribution / request identity authorization)High
• open-iscsi / open-isns - iscsiuio control socket authorization and iSNS record handling: Three related defectsCVE-2026-44944 · open-iscsi / open-isns - iscsiuio control socket authorization and iSNS record handlingHigh
• GitLab EE: developer-level user can run a policy test pipeline and read protected CI/CD variablesCVE-2026-79708 · GitLab EE (security policy test pipelines, CI/CD variable scope validation)High