AMD SEV firmware: missing authentication lets a hypervisor forge SEV-TIO guest request messages

Impact

SEV firmware does not authenticate SEV-TIO guest request messages, so a malicious hypervisor can forge them. AMD says this could compromise both the confidentiality and the integrity of SEV-SNP guest memory. SEV-TIO is the trusted-I/O path for assigning devices to confidential VMs, so this matters most to operators planning confidential GPU or device passthrough on EPYC 9005/8005. Only those generations are listed.

Who can reach it

Requires control of the hypervisor on an affected EPYC 9005/8005 host. Not reachable from a guest or the network.

What to do

Apply the SEV firmware fix from AMD-SB-3038. The record gives no fixed version or delivery mechanism. Check the bulletin and your OEM for the platform firmware release, and plan host maintenance on SEV-SNP/SEV-TIO nodes.

References

Related entries

• Arista EOS: crafted BGP-LS message from an established peer restarts the BGP agentCVE-2026-120978 · Arista EOS (BGP agent, BGP-LS with Dynamic Path Selection consumer role)Medium
• Arista EOS: crafted BGP packet from a peer restarts the BGP agent when VPLS-BGP is enabledCVE-2026-120980 · Arista EOS (BGP agent, VPLS-BGP)Medium
• Arista EOS: BGP peer can churn VPLS pseudowire routes toward other legitimate peersCVE-2026-120981 · Arista EOS (VPLS-BGP pseudowire route advertisement)Medium
• Arista EOS: crafted packets from a BGP peer restart BGP and drop every session when SR-TE is configuredCVE-2026-121286 · Arista EOS (BGP, multi-agent routing model, SR-TE address family)Medium
• NVIDIA DGX Spark: out-of-bounds read in standalone MM firmware discloses information across a scope boundaryCVE-2026-24225 · NVIDIA DGX Spark (standalone MM firmware)Medium
• NVIDIA DGX Spark: UEFI administrator password protection can be bypassed by a privileged local userCVE-2026-47624 · NVIDIA DGX Spark (UEFI administrator password protection)Medium