-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-EN-26:20.microcode Errata Notice
The FreeBSD Project
Topic: Early loading of Intel CPU microcode fails for some CPUs
Category: core
Module: ucode
Announced: 2026-08-25
Affects: All supported versions of FreeBSD.
Corrected: 2026-06-15 18:01:43 UTC (stable/15, 15.1-STABLE)
2026-08-25 16:01:16 UTC (releng/15.1, 15.1-RELEASE-p3)
2026-08-25 16:00:56 UTC (releng/15.0, 15.0-RELEASE-p13)
2026-07-14 14:56:07 UTC (stable/14, 14.4-STABLE)
2026-08-25 16:00:22 UTC (releng/14.4, 14.4-RELEASE-p9)
For general information regarding FreeBSD Errata Notices and Security
Advisories, including descriptions of the fields above, security
branches, and the following sections, please visit
.
I. Background
Modern x86 CPUs support updates to their microcode. FreeBSD can apply these
updates in two ways: "early loading," performed by the kernel during boot
before CPU feature detection, and "late loading," performed after boot by
cpucontrol(8) or the microcode_update rc(8) service.
An Intel microcode distribution file may describe the CPUs an update applies
to using a primary signature in the image header and, optionally, an extended
signature table listing additional matching signatures.
II. Problem Description
The kernel's early-loading matcher, ucode_intel_match() in
sys/x86/x86/ucode.c, contained an inverted bounds check that caused the
extended signature table to always be treated as absent. Consequently, a CPU
whose matching signature+platform pair appears only in an image's extended
signature table was never matched during early loading, and its microcode
update was not applied. The kernel reports "CPU microcode: no matching
update found" in this case.
Late loading via cpucontrol(8) is not affected. There, the userland matcher
parses extended signature tables correctly.
III. Impact
On affected Intel CPUs, early loading applies no microcode update even when a
suitable update is present in the loaded file. Such systems run with only
the microcode installed by the system firmware (BIOS/UEFI), which may be
older than the packaged update and may lack functional or security-related
errata fixes. At the time of writing, 19 CPU signatures / 58
signature+platform combinations in the packaged Intel microcode are affected,
spanning various Alder Lake, Raptor Lake, Sapphire Rapids, and Emerald Rapids
steppings, as well as some newer Intel Core Ultra client processors.
To determine whether your system is affected, run the following commands as
root:
# kldload -n cpuctl
# cpucontrol -i 0x01 /dev/cpuctl0
If the first hexadecimal value (the CPUID signature) appears in the
following list, the system is affected by the bug.
0x000806f4
0x000806f5
0x000806f6
0x000806f7
0x00090675
0x000906a4
0x000b0674
0x000b06a3
0x000b06a8
0x000b06f2
0x000b06f5
0x000b06f6
0x000b06f7
0x000c0652
0x000c0664
0x000c06a2
0x000c06c2
0x000c06c3
0x000c06f1
Note, for signature 0x000906a4, only systems with platform ID 7 are
affected. These report 0x001c0000 as the first value in the output of
"cpucontrol -m 0x17 /dev/cpuctl0".
Systems whose CPU signature matches an image's primary header, and all
AMD systems, are unaffected.
IV. Workaround
Use late loading instead of, or in addition to, early loading. Install both
sysutils/cpu-microcode-intel and sysutils/cpu-microcode-rc and enable the
service:
# sysrc microcode_update_enable="YES"
# service microcode_update start
V. Solution
Upgrade your system to a supported FreeBSD stable or release / security
branch (releng) dated after the correction date, and reboot the system.
Perform one of the following:
1) To update your system installed from base system packages:
Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or
arm64 platforms, which were installed using base system packages, can be
updated via the pkg(8) utility:
# pkg upgrade -r FreeBSD-base
# shutdown -r now
2) To update your system installed from binary distribution sets:
Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms
which were not installed using base system packages can be updated via the
freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
# shutdown -r now
3) To update your system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/EN-26:20/microcode.patch
# fetch https://security.FreeBSD.org/patches/EN-26:20/microcode.patch.asc
# gpg --verify microcode.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch -E -p0 < /path/to/patch
c) Recompile your kernel as described in
and reboot the
system.
VI. Correction details
This issue is corrected as of the corresponding Git commit hash in the
following stable and release branches:
Branch/path Hash Revision
- -------------------------------------------------------------------------
stable/15/ 2a1eaaf331f7 stable/15-n283974
releng/15.1/ a0e96483e2ce releng/15.1-n283597
releng/15.0/ 4a66af1ce037 releng/15.0-n281100
stable/14/ 38cbd2588f0b stable/14-n274496
releng/14.4/ c905b341204e releng/14.4-n273756
- -------------------------------------------------------------------------
Run the following command to see which files were modified by a
particular commit:
# git show --stat
Or visit the following URL, replacing NNNNNN with the hash:
To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:
# git rev-list --count --first-parent HEAD
VII. References
The latest revision of this advisory is available at
-----BEGIN PGP SIGNATURE-----
iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmqN3XAbFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvse4P/isqmBRUFLLUnVFS/AD7
Wlg20e54L4CRORCqhL1p33WdcKs6bHg7Tgvutwy23HmX9ISrOanm5WkFq2qN16qc
olNJDvlXHLeIseDH6WQrxWiBooYqqJpLOJyolqB+R0TIGRvRMidbdM24gHyOCWST
MvraPYkqkQH9DSO1CYUHoLTcVLek/l9ux1p2WApHSqOw7GPcltiYUnyvKrOqBxYs
DD4n0GIw0JfsXK1L9MLXJILjROUpItDHnv1CsG8VVaWQI0c+5826dTVoFsDQ1RUc
mcIiBiWP/gmKxl48wzjq9qZccGN2vHMLrFYA0Zu/syqpB2g5b0zQbm9iKIak+YIJ
mKHTUGAZ0YJpQAXf8f1q+pED91Veh9k0fIvnSwsDa2dfgk2XMfZeWIyHbddxS0p6
fvnCroT4sMvequ2wpC64jpebASmwjiZYYY9gPk2TdgOlu83PnYUkMbT4gv5RHgIo
qwK7WQ2bDO3GaRHGQ3Zfo/Dl97bGg6KDDZZEbFOBv9hWu2bKgmLMvo2HtgKGGLDa
UBGypDYWC0abbtbaqTBFtJsvUbcpf6llG/lJT6YaipVrqBjLyNFJhETS1zNIQQSr
Y8pvUc+tsqlLmrI4AaqcvIwC0OY6ATppQ49ZMpujaDf3nj9wG9vw6d1l12kIWjEE
0XE3NnDLvAne7G2cC+ktwGzB
=KmJ4
-----END PGP SIGNATURE-----