AMD Confirms Two TPM 2.0 Flaws: False Attestations on Ryzen from…

Two vulnerabilities in AMD's TPM 2.0 firmware jeopardize the hardware attestation chain on Ryzen processors. Patched firmware has been available since May.

AMD confirmed two vulnerabilities in its TPM 2.0 firmware on August 11, 2026, affecting Ryzen processors from the 3000 series through the AI series, with CVSS 4.0 scores of 8.5 and 8.3. The paradox is that corrected firmware had already been delivered to OEMs between May and June, while platforms with Microsoft Pluton still await updates. The discovery, credited to Intel researchers, exposes a systemic fragility: the component designed to guarantee system integrity becomes a vector for falsifying trust itself.

Key Takeaways

CVE-2026-6726 and CVE-2026-6727 affect the Trusted Computing Group's TPM 2.0 reference code, not proprietary AMD code; Intel fTPM is also affected.
Both require local access with elevated privileges and undermine the hardware attestation chain, enabling generation of false attestation keys.
Corrected ComboAM4PI and ComboAM5PI firmware was distributed to OEMs between May 18 and May 31, 2026; ASUS, MSI, GIGABYTE, and ASRock have already released updated BIOSes.
Ryzen AI platforms with Microsoft Pluton have not yet received patches: AMD projects updates for August 2026.

The Mechanism: How TPM Attestation Is Falsified

The two vulnerabilities strike distinct cryptographic mechanisms but converge on the same goal: compromising the proof that a key actually resides in the TPM. CVE-2026-6726 is a use-after-free caused by an error in separating object types in memory within the TPM 2.0 reference code. This defect can affect TPM2_Certify, the function that certifies the properties of a key loaded in the module, leaving residual information from previously used objects.

CVE-2026-6727 is a timing side-channel in RSA-OAEP decryption. Differing processing times during the padding check create a measurable side channel: through the so-called Manger attack, an attacker with local access can recover the cryptographic plaintext and generate false attestation keys. According to AMD bulletin AMD-SB-7064 as reported by Igor's LAB, both vulnerabilities are classified as "non-AMD" because they originate in the Trusted Computing Group's TPM 2.0 reference code.

The CERT/CC, which managed the coordinated multi-vendor disclosure under tracking ID VU#431093, confirms that both vulnerabilities require local access with elevated privileges. As Igor's LAB quotes the AMD bulletin: "Both attacks are local and require elevated privileges. There can therefore be no talk of a vulnerability that can simply be exploited from the Internet against arbitrary Ryzen PCs."

An Intel Discovery That Lays Bare Reference Implementations

The vulnerabilities were discovered by Intel security researchers Liran Perez, Zecharye Galitzky, Shai Sarfati, and Yanai Moyal. The fact that Intel researchers found flaws in AMD's TPM firmware is not market irony but a structural indicator: shared reference implementations in the TPM ecosystem expose every vendor that adopts them without substantial independent modification.

The CERT/CC lists Intel itself as an affected vendor, with its fTPM (firmware TPM) marked "Affected" in the affected parties table. Other vendors such as Dell, HP, Lenovo, Qualcomm, NVIDIA, and VMware are listed with "Unknown" status in the CERT/CC database, a limitation the dossier does not allow us to resolve with assertive statements. What emerges clearly is that the vulnerability recognizes no competitive boundaries: anyone implementing the TCG reference code without independent audit shares the same attack surface.

"The machine could pass device compliance checks and slip through conditional access gates while actually harboring malware, a backdoor, or unauthorized firmware."

Timeline and Fragmentation: When the Patch Isn't Enough

Corrected firmware was delivered to OEMs on differentiated timelines per platform. According to VideoCardz, ComboAM4PI 1.0.0.11 for Ryzen 3000 was distributed on May 18, 2026; ComboAM4v2PI 1.2.0.12 for Ryzen 4000/5000 on May 27; ComboAM5PI 1.3.0.1b for AM5 platforms on May 21, followed by ComboAM5PI 1.2.0.3k on May 31. Ryzen Embedded processors received updates in July 2026, according to TechSpot.

Fragmentation emerges in the handoff from base firmware to individual motherboard BIOSes. ASUS released ComboAM5 PI 1.3.0.1b on boards such as the PRIME X870-P WIFI in June, followed by a Patch A on July 2. MSI, GIGABYTE, and ASRock also have updates available. However, TechTimes reports that some older AM4 motherboards, such as ASUS B550 models, have not received BIOS updates since January 2026. AMD projects updates for Ryzen AI platforms with Microsoft Pluton for August 2026, a date still unconfirmed at time of publication.

Enterprise Risk: When the Root of Trust Rots

The impact of the two vulnerabilities is measured against the fundamental premise of TPM architecture: that the attestation key is inextricably bound to the hardware. If that premise collapses, so does the trust chain underpinning Windows 11, BitLocker, Secure Boot, and enterprise zero-trust frameworks. A compromised machine can generate false TPM attestations, pass compliance checks, and access resources protected by conditional access gates while actually hosting malware or unauthorized firmware.

Risk to consumers is mitigated by the prerequisites of local access with elevated privileges. For enterprises managing fleets, the problem shifts to two planes: how many machines were actually patched between May and June without administrators knowing the underlying severity, and how many Ryzen AI platforms with Pluton remain exposed awaiting patches. The TCG recommends, beyond firmware updates, revoking and regenerating attestation keys and migrating from RSA to ECC keys where possible. These recommendations appear in the cited sources and specifically address post-patch management of compromised keys.

What to Do Now

Verify the TPM firmware version in BIOS: look for ComboAM4PI 1.0.0.11 or later for AM4 Ryzen 3000 platforms, ComboAM4v2PI 1.2.0.12 for Ryzen 4000/5000, ComboAM5PI 1.3.0.1b or 1.2.0.3k for AM5.
Check the motherboard manufacturer's site for updated BIOSes: ASUS, MSI, GIGABYTE, and ASRock have released corrected versions, but availability varies by model.
For Ryzen AI platforms with Microsoft Pluton, monitor for updates projected for August 2026: at time of publication, corrected firmware has not yet been distributed.

Public awareness arrives months after technical fixes were available, and that delay is itself part of the problem. Infrastructures managing thousands of endpoints must now retroactively reconstruct the patch state of their fleets, knowing the corrected firmware was already circulating when no one knew of the severity. It is a case study in how coordinated disclosure, while an industry standard, can leave exposure windows managed only by those with upstream visibility.

Information has been verified against cited sources and is current as of publication.

Sources

Sources and references