CVE-2025-22047

What it actually does

Incorrect return value (-1 instead of false) from __apply_microcode_amd() when verify_sha256_digest() fails causes boolean promotion to treat failure as success, allowing invalid AMD microcode to be applied.

Why it matters to the business

Organizations running affected Linux kernels on AMD systems risk undetected loading of corrupted processor updates, which can cause instability, crashes, or weakened hardware protections without warning.

How an attack unfolds

An attacker or supply-chain actor provides microcode with an invalid SHA256 digest during kernel-initiated AMD microcode loading; the flawed return-value handling treats the failure as success and proceeds with the bad update.

How to fix it

Upgrade Linux kernel to a fixed version such as 6.6.87 or apply commit 763f4d638f71cb45235395790a46e9f9e84227fd; Red Hat Enterprise Linux 8 users should update libsoup packages to 0:2.62.3-6.el8_10.

How to confirm the fix worked

Confirm kernel version is at or above the listed fixed releases; inspect __apply_microcode_amd() source to verify it returns false on verify_sha256_digest() failure.

Typical attack path

1. Target AMD x86 Linux system running vulnerable kernel
2. Trigger or supply microcode update containing invalid digest
3. verify_sha256_digest() correctly fails but __apply_microcode_amd() returns -1
4. Kernel treats result as success and applies invalid microcode

How to detect it

Search kernel logs for microcode update attempts around the time of the flawed function; look for unexpected success messages following digest verification failures.

What your security team should do

• Prioritize kernel upgrades on all AMD systems within standard change windows
• Monitor vendor advisories for any backports to older stable branches
• Review microcode loading logs after patching to ensure clean application