AMD Confirms a Bug in Zen 5 Affecting Cryptographic Security; Fixes Coming This Month

AMD has released a security notice confirming a bug in its Zen 5 architecture that could impact the security of systems using these processors.

The vulnerability is related to the x86-64 RDSEED instruction, which is a hardware-based random number generator within the processor. This instruction is used when generating cryptographic keys or securing systems.

Bug Causes RDSEED 16-bit and 32-bit Instructions to Generate Zero

It has been found that processors using the Zen 5 architecture have a bug that causes the 16-bit and 32-bit versions of the RDSEED instruction to sometimes fail and return the number 0 as a result while still marking the operation as successful.

In those cases, the system might treat 0 as a valid random number, which could allow malicious software to exploit the issue, since the output would be predictable rather than truly random.

The 64-bit version of the instruction is not affected, meaning that only systems using the 32-bit or 16-bit RDSEED instructions are vulnerable.

AMD has announced that it is already working on a new version of its AGESA firmware and microcode to fix the problem. Until the patch is released, developers are advised to use the 64-bit version of the instruction whenever possible. If that is not an option, they should modify their code to reject 0 as a valid random value. System administrators can also disable the RDSEED instruction if necessary.

Firmware Updates Arriving in November

All processors based on the Zen 5 architecture are affected. AMD has confirmed that an AGESA firmware update will be rolled out to resolve the issue.

For AMD EPYC 9005 Series processors, the AGESA TurinPI 1.0.0.8 update will be released on November 14, though a microcode update has already been made available as a temporary mitigation. The AMD EPYC Embedded 9005 Series will receive the same update on the same day, while the AMD EPYC Embedded 4005 and AMD Ryzen Embedded 9000 Series will receive their updates in January 2026.

Consumer AMD Ryzen and Threadripper processors will receive the firmware update on November 25, covering the following models:

• AMD Ryzen™ 9000 Series Desktop
• AMD Ryzen™ 9000HX Series
• AMD Ryzen™ AI 300 Series
• AMD Ryzen™ AI Z2 Series Extreme
• AMD Ryzen™ AI Max 300 Series
• AMD Ryzen™ Threadripper™ 9000
• AMD Ryzen™ Threadripper™ PRO 9000 WX-Series
• AMD Ryzen™ Z2 Series Extreme