CVE-2026-40671

🗓️ Two dates, both from AMD's own bulletins. 12 Aug 2026: the SEV firmware (3059) and microcode (3061) release date AMD prints. 10 Nov 2026: the day both bulletins went up. That is 90 days (derived).

🔐 What the two flaws are, in AMD's words CVE-2026-0462, CVSS 5.9: a malicious hypervisor may redirect MMIO access, "loss of guest memory integrity". SEV-SNP only per AMD's SEV table. CVE-2026-40671, CVSS 4.9: incomplete cleanup in VMRUN error handling, guest register state readable by a privileged attacker through a TSA side channel.

🧩 The catch: only 3059 prints attestation values (Mitigation Bit, TCB[SNP]). 3061 prints none, so a verifier has nothing listed to look for on that CVE.

📦 EPYC platform firmware: targets of Nov'26 and Dec'26, and the two bulletins disagree on the month for the same PI names (MilanPI-SP3 1.0.0.L, TurinPI 1.0.0.C). Embedded parts run to Apr'27. Your BIOS date is your OEM's, not AMD's.

🕳️ Not stated: any exploit or use in the wild, which cloud hosts are unpatched, whether the August firmware alone closes either issue.

AMD sells the processors, so the dates are its own account.

If attestation passes today, what does the verifier know about the host's patch level?

🔗 https://t.co/we1IUh4K5X

#AMD #SEVSNP #ConfidentialComputing #EPYC #CloudSecurity #Virtualization #Firmware #CVE202640671 #CVE20260462 #Attestation #InfoSec #CyberSecurity #DataCenter #HardwareSecurity