Description
The Linux kernel before 2.6.16.9 and the FreeBSD kernel, when running on AMD64 and other 7th and 8th generation AuthenticAMD processors, only save/restore the FOP, FIP, and FDP x87 registers in FXSAVE/FXRSTOR when an exception is pending, which allows one process to determine portions of the state of floating point instructions of other processes, which can be leveraged to obtain sensitive information such as cryptographic keys. NOTE: this is the documented behavior of AMD64 processors, but it is inconsistent with Intel processors in a security-relevant fashion that was not addressed by the kernels.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | kernel-source-2.4.27 | 2.4.27-10sarge3 | DSA-1097-1 |
| Debian 3.1 | kernel-source-2.6.8 | 2.6.8-16sarge3 | DSA-1103 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | kernel +8 | 2.6.9-42.EL | RHSA-2006:0575 |
| RHEL 3 | kernel +8 | 2.4.21-47.EL | RHSA-2006:0437 |
Advisories 4
- RHSA-2006:0575 Red Hat Security Advisory: Updated kernel packages available for Red Hat Enterprise Linux 4 Update 4 Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2006:0437 Red Hat Security Advisory: Updated kernel packages for Red Hat Enterprise Linux 3 Update 8 Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1097-1 kernel-source-2.4.27 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1103 kernel-source-2.6.8 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- oval:org.mitre.oval:def:9995 vdb-entry signature
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=187911
- RHSA-2006:0437 vendor-advisory
- 22876 third-party-advisory
- http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.9
- 19735 third-party-advisory
- ADV-2006-4502 vdb-entry
- ADV-2006-2554 vdb-entry
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=187910
- RHSA-2006:0579 vendor-advisory
- 20716 third-party-advisory
- 22875 third-party-advisory
- FEDORA-2006-423 vendor-advisory
- 21136 third-party-advisory
- USN-302-1 vendor-advisory
- http://kb.vmware.com/kb/2533126
- 24746 vdb-entry
- 24807 vdb-entry
- 21983 third-party-advisory
- ADV-2006-4353 vdb-entry
- 21035 third-party-advisory
- http://www.vmware.com/download/esx/esx-213-200610-patch.html
- DSA-1097 vendor-advisory
- RHSA-2006:0575 vendor-advisory
- SUSE-SA:2006:028 vendor-advisory
- 20061113 VMSA-2006-0009 - VMware ESX Server 3.0.0 AMD fxsave/restore issue mailing-list
- ADV-2006-1426 vdb-entry
- 19715 third-party-advisory
- 1015966 vdb-entry
- 20060419 FreeBSD Security Advisory FreeBSD-SA-06:14.fpu mailing-list
- 17600 vdb-entry
- http://support.avaya.com/elmodocs2/security/ASA-2006-180.htm
- DSA-1103 vendor-advisory
- http://www.vmware.com/download/esx/esx-254-200610-patch.html
- 21465 third-party-advisory
- SUSE-SU-2014:0446 vendor-advisory
- [linux-kernel] 20060419 RE: Linux 2.6.16.9 mailing-list
- ADV-2006-1475 vdb-entry
- 20061113 VMSA-2006-0006 - VMware ESX Server 2.5.3 Upgrade Patch 4 mailing-list
- amd-fpu-information-disclosure(25871) vdb-entry
- http://support.avaya.com/elmodocs2/security/ASA-2006-200.htm
- 20398 third-party-advisory
- 20061113 VMSA-2006-0007 - VMware ESX Server 2.1.3 Upgrade Patch 2 mailing-list
- http://security.freebsd.org/advisories/FreeBSD-SA-06:14-amd.txt
- 22417 third-party-advisory
- 19724 third-party-advisory
- 20671 third-party-advisory
- 20061113 VMSA-2006-0005 - VMware ESX Server 2.5.4 Upgrade Patch 1 mailing-list
- 20914 third-party-advisory