Loading story…
The Linux kernel is introducing support for PCI Express (PCIe) Link Encryption in version 6.19, a feature developed collaboratively by Intel, AMD, and Arm to enhance the security of cloud server infrastructure. This new capability leverages certificates and keys to encrypt data transmitted between CPUs and hardware components over PCIe, aiming to prevent unauthorized devices from intercepting sensitive information. The encryption protocol, known as Integrity and Data Encryption (IDE), is managed through a Trusted Execution Environment (TEE) Security Manager, providing an additional layer of protection for cloud providers against hardware-based attacks.
Concurrently, three significant vulnerabilities have been disclosed in the PCIe IDE protocol, affecting PCIe Base Specification Revision 5.0 and later. These flaws—CVE-2025-9612, CVE-2025-9613, and CVE-2025-9614—could allow local attackers to reorder traffic, redirect completion timeouts, or inject stale data, potentially leading to information disclosure, privilege escalation, or denial of service. While these vulnerabilities require physical or low-level access to exploit, they highlight the ongoing challenges in securing PCIe communications, even as new encryption features are being integrated into major operating systems like Linux.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
In response to the specification-level weaknesses, PCI-SIG released a Draft Engineering Change Notice to address the IDE issues in future PCIe specifications. Existing hardware was still expected to rely on firmware-based mitigations from vendors.
The Linux kernel project announced support for PCI Express Link Encryption in version 6.19, a feature developed by Intel, AMD, and Arm to protect data between CPUs and PCIe devices. The design uses certificates and keys managed by a TEE Security Manager to authenticate devices and help prevent rogue hardware from intercepting PCIe traffic.
Following disclosure, Intel and AMD issued advisories for affected products and told customers to install vendor firmware updates. The guidance focused on reducing risk in sensitive environments such as servers, data centers, and trusted execution deployments.
The three PCIe IDE vulnerabilities were publicly disclosed with guidance from PCI-SIG and CERT/CC. They recommended updating to the latest PCIe 6.0 standard and applying relevant errata, while noting the flaws require local or physical access rather than remote exploitation.
Intel researchers identified three flaws in the PCIe Integrity and Data Encryption protocol, later tracked as CVE-2025-9612, CVE-2025-9613, and CVE-2025-9614. The issues affect PCIe Base Specification 5.0 and later and could let attackers with physical or low-level access compromise confidentiality, integrity, or availability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcenews.risky.biz
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Intel disclosed multiple vulnerabilities in Linux kernel-mode Ethernet drivers for its **700 Series**, **800 Series**, and **I350 Series** network adapters, warning that authenticated local users could exploit the flaws for **privilege escalation**, **information disclosure**, or **denial of service**. The most severe issue listed in `INTEL-SA-01296` is **CVE-2025-24325**, rated **CVSS 4.0 9.3 Critical**, affecting some Intel 800 Series Ethernet drivers before version `1.17.2`; Intel said the advisory covers eight CVEs tied to improper input validation, insufficient control flow management, exceptional-condition handling, and integer overflow. A separate advisory, `INTEL-SA-01335`, covers Intel 700 Series and I350 Series Linux drivers, including 700 Series flaws such as **CVE-2025-24486**, **CVE-2025-21086**, and **CVE-2025-25273**, which can expose vulnerable kernel code paths in the `i40e` driver and potentially lead to root-level compromise on affected Linux systems. Intel said affected 700 Series driver versions earlier than `2.28.5` and I350 Series driver versions earlier than `5.19.2` should be upgraded, while 800 Series deployments should move to `1.17.2` or later; fixes are also available through the **Intel Ethernet Adapter Complete Driver Pack** version `30.0.1` or later. The impacted hardware spans widely deployed enterprise and cloud platforms, including Intel **I710**, **X710**, **XL710**, **XXV710**, **V710**, **X722**, and multiple Xeon- and Atom-based systems. Intel said the vulnerabilities were discovered internally and released under coordinated disclosure after mitigations became available, and public reporting indicated no proof-of-concept exploit had been released for the highlighted 700 Series issues at the time of publication.
Jun 29, 2026
Researchers from KU Leuven and the University of Birmingham have demonstrated new physical attacks that undermine the security guarantees of trusted execution environments (TEEs) provided by Intel and AMD processors. These TEEs, specifically Intel's Software Guard Extensions (SGX) and AMD's Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP), are widely used in cloud computing to protect sensitive data and operations from attackers, even those with administrative access to the underlying infrastructure. The attacks, named Battering RAM and Wiretap, exploit vulnerabilities in the deterministic encryption schemes used by both SGX and SEV-SNP. By inserting a low-cost hardware interposer—costing as little as $50—between the CPU and DDR4 memory modules, attackers can observe and manipulate encrypted data in real time. The Battering RAM attack allows adversaries to not only view but also modify encrypted data, enabling the introduction of software backdoors or data corruption within protected enclaves. The Wiretap attack, on the other hand, enables passive decryption of sensitive data without detection. These attacks are particularly concerning for cloud environments, where confidential computing workloads rely on hardware-level memory encryption to secure data from potentially untrusted cloud service providers. The interposer operates transparently during system startup, passing all trust checks, and can later be activated to redirect protected memory addresses to attacker-controlled locations. On Intel platforms, Battering RAM enables arbitrary read and write access to enclave memory, while on AMD systems, it bypasses recent firmware mitigations and allows the introduction of arbitrary backdoors into virtual machines. The attacks highlight fundamental limitations in the current design of hardware-based memory encryption, especially when deterministic encryption is used. All systems using DDR4 memory and relying on these TEEs for confidential computing are potentially vulnerable. The research underscores the need for more robust hardware security mechanisms and may prompt cloud providers and customers to reassess their trust in existing enclave technologies. The findings have significant implications for the security of cloud-hosted applications, including those used by messaging platforms like Signal and WhatsApp, which depend on these protections to safeguard user data. The attacks demonstrate that physical access to cloud hardware, even with minimal resources, can compromise the confidentiality and integrity of sensitive workloads. Both Intel and AMD are expected to review these findings and consider architectural changes or additional mitigations in future hardware generations. The research also raises questions about the adequacy of current cloud security recommendations and the potential for insider threats within data centers. Organizations relying on SGX or SEV-SNP for critical workloads should closely monitor vendor advisories and consider additional layers of defense. The academic community continues to play a vital role in uncovering and publicizing such vulnerabilities, driving improvements in hardware security.
Jun 29, 2026
Linux kernel security reporting highlighted two separate Linux-focused issues: a long-standing **x86 page-fault handling** logic flaw and newly optimized **page-cache side-channel** techniques. An Intel engineer (Cedric Xing) identified that, since 2020, parts of the x86 `do_page_fault()` path could leave **hardware interrupts** enabled in situations where the kernel’s logic assumed they were disabled, due to conflating address range (user vs. kernel) with execution context; a fix was merged into **Linux 6.19** with plans to backport to stable branches. Separately, researchers from Graz University of Technology described significantly faster Linux **page cache attacks**, reducing cache-flush time from ~149 ms to ~0.8 µs and enabling tighter attack loops (0.6–2.3 µs). The work describes potential impacts including more precise overlay/keylogging-style attacks, inter-keystroke timing inference, container/Docker file-activity insights, and user-activity inference in applications such as Discord and Firefox; reporting noted that only **CVE-2025-21691** has been remediated by the Linux kernel security team. A third item—Imagination Technologies’ GPU driver vulnerability bulletin—covers unrelated **GPU DDK** issues (information leak and UAF-class bugs) and does not pertain to the Linux kernel x86/page-cache topics.
Jun 29, 2026