Denial of Service Vulnerability in Intel Microcode Package
Summary
CVE-2025-21090: Missing reference to active allocated resource for some Intel(R) Xeon(R) processors may allow an authenticated user to potentially enable denial of service via local access. Affects intel-ucode versions < 20250812-r0. Fixed in 20250812-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Intel Microcode package is essential for the proper functioning of Intel processors, including Xeon processors. It provides updates to the processor's firmware, enhancing performance and security. However, certain versions of this package are vulnerable to a specific issue that could allow an authenticated user to exploit the system.
Vulnerability Detail
CVE-2025-21090 is a vulnerability that arises from a missing reference to an active allocated resource in some Intel(R) Xeon(R) processors. This flaw can potentially allow an authenticated user to enable a denial of service condition via local access. The vulnerability affects multiple versions of the Intel Microcode package across various Debian releases, indicating a widespread issue that could impact many systems relying on these processors.
How To Fix
Minimum fixed version
20250812-r0
This is the first release that contains the fix.
sudo apk add --upgrade intel-ucodeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available updates as soon as they are released.
Conclusion
CVE-2025-21090 is a significant vulnerability affecting the Intel Microcode package across multiple Debian versions. Users are encouraged to update their systems promptly to mitigate the risk of denial of service. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for intel-ucode →
FAQ
CVE-2025-21090 is a vulnerability in the Intel Microcode package that may allow an authenticated user to enable denial of service on affected Intel Xeon processors.
You can use the Vulert platform to check if your application is affected by this vulnerability. Simply upload your manifest file, such as package-lock.json, to monitor for open-source vulnerabilities.
While there are no specific workarounds, it is advisable to limit access to the system and monitor for any unusual activity until the package can be updated.
The vulnerability allows for denial of service, which can disrupt system operations. While it requires authenticated access, it is still important to address it promptly.
You can find more information about the Intel Microcode package and its updates in the official Debian package repositories or on the Intel website.
Related vulnerabilities
Recent vulnerabilities recorded for intel-ucode.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
