CVE-2026-40670
Quick assessment
Affected
AMD AMD EPYC™ 9004 Series Processors
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
AMD 安全加密虚拟化 - 安全嵌套分页（SEV-SNP）中对异常或特殊条件的检查不当，可能使拥有特权的攻击者将内存映射 I/O（MMIO）区域与动态随机存取存储器（DRAM）区域重叠，从而导致数据完整性丧失。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-40670
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Improper check for unusual or exceptional conditions in AMD Secure Encrypted Virtualization - Secure Nested Paging (SEV-SNP) could allow a privileged attacker to potentially overlap MMIO regions with DRAM regions resulting in loss of integrity.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对因果或异常条件的不恰当检查
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| AMD | AMD EPYC™ 9004 Series Processors | GenoaPI_1.0.0.J | - |
|
| AMD | AMD EPYC™ 7003 Series Processors | MilanPI-SP3_1.0.0.K | - |
|
| AMD | AMD EPYC™ 9005 Series Processors | TurinPI_1.0.0.B | - |
|
| AMD | AMD EPYC™ 8004 Series Processors | GenoaPI_1.0.0.J | - |
|
| AMD | AMD EPYC™ 8005 Series Processors | TurinPI_1.0.0.B | - |
|
| AMD | AMD EPYC™ Embedded 7003 Series Processors | EmbMilanPI-SP3 1.0.0.E | - |
|
| AMD | AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Genoa") | EmbeddedGenoaPI_1.0.0.E | - |
|
| AMD | AMD EPYC™ Embedded 9004 Series Processors (formerly codenamed "Bergamo") | EmbeddedGenoaPI_1.0.0.E | - |
|
| AMD | AMD EPYC™ Embedded 8004 Series Processors | EmbeddedGenoaPI_1.0.0.E | - |
|
| AMD | AMD EPYC™ Embedded 9005 Series Processors | EmbeddedTurinPI_SP5_1005 | - |
|
II. Public POCs for CVE-2026-40670
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-40670
请登录查看更多情报信息。
Other References for CVE-2026-40670 (1)
Same Patch Batch · AMD · 2026-11-10 · 24 CVEs total
| CVE-2025-0008 | 8.4 HIGH | 某软件 SDU 验证不足致本地调试绕过 |
| CVE-2025-48504 | 6.8 MEDIUM | SEV 固件资源释放后操作漏洞致机密性完整性丧失 |
| CVE-2026-0480 | 6.0 MEDIUM | AMD SEV 固件认证缺失漏洞致内存机密性受损 |
| CVE-2025-29941 | 6.0 MEDIUM | SEV固件伪随机数种子漏洞致密钥泄露 |
| CVE-2026-0435 | 6.0 MEDIUM | AMD SEV固件资源释放后操作漏洞 |
| CVE-2026-0003 | 5.9 MEDIUM | AMD SEV 固件降级漏洞：静态密钥导致内存解密 |
| CVE-2026-28248 | 5.9 MEDIUM | AMD SEV 固件行为工作流执行不当致完整性丧失 |
| CVE-2026-28247 | 5.9 MEDIUM | AMD SEV 固件内存镜像访问控制漏洞致完整性丢失 |
| CVE-2025-0027 | 5.9 MEDIUM | AMD SEV固件访问控制漏洞致RMP保护绕过 |
| CVE-2025-62621 | 5.9 MEDIUM | AMD SEV固件违规致RMP绕过，破坏SEV-SNP内存完整性 |
| CVE-2025-62620 | 5.9 MEDIUM | QEMU 输入验证漏洞致内存完整性丢失 |
| CVE-2025-29940 | 5.9 MEDIUM | AMD SEV 固件未验证所有权漏洞致数据完整性受损 |
| CVE-2025-52535 | 5.9 MEDIUM | AMD SEV 固件资源重用漏洞致内存完整性丧失 |
| CVE-2025-54503 | 5.9 MEDIUM | SEV 固件内存重叠处理缺陷致完整性受损 |
| CVE-2025-54504 | 5.9 MEDIUM | AMD SEV 固件访问控制不足漏洞致完整性受损 |
| CVE-2026-0454 | 4.6 MEDIUM | AMD SEV 固件越界写入漏洞致完整性受损 |
| CVE-2026-40668 | 4.6 MEDIUM | AMD SEV 固件认证绕过漏洞 |
| CVE-2026-28249 | 4.6 MEDIUM | AMD SEV 固件共享状态一致性漏洞致完整性受损 |
| CVE-2024-36309 | 4.6 MEDIUM | AMD NBIO 锁位缺失导致重映射漏洞 |
| CVE-2026-40669 | 4.0 MEDIUM | AMD SEV 固件越界漏洞致内存完整性受损 |
Showing top 20 of 24 CVEs. View all on vendor page → →