-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

============================================================================= FreeBSD-EN-26:20.microcode Errata Notice
The FreeBSD Project

Topic: Early loading of Intel CPU microcode fails for some CPUs

Category: core
Module: ucode
Announced: 2026-08-25
Affects: All supported versions of FreeBSD.
Corrected: 2026-06-15 18:01:43 UTC (stable/15, 15.1-STABLE)
2026-08-25 16:01:16 UTC (releng/15.1, 15.1-RELEASE-p3)
2026-08-25 16:00:56 UTC (releng/15.0, 15.0-RELEASE-p13)
2026-07-14 14:56:07 UTC (stable/14, 14.4-STABLE)
2026-08-25 16:00:22 UTC (releng/14.4, 14.4-RELEASE-p9)

For general information regarding FreeBSD Errata Notices and Security Advisories, including descriptions of the fields above, security
branches, and the following sections, please visit <URL:https://security.FreeBSD.org/>.

I. Background

Modern x86 CPUs support updates to their microcode. FreeBSD can apply these updates in two ways: "early loading," performed by the kernel during boot before CPU feature detection, and "late loading," performed after boot by cpucontrol(8) or the microcode_update rc(8) service.

An Intel microcode distribution file may describe the CPUs an update applies
to using a primary signature in the image header and, optionally, an extended signature table listing additional matching signatures.

II. Problem Description

The kernel's early-loading matcher, ucode_intel_match() in
sys/x86/x86/ucode.c, contained an inverted bounds check that caused the extended signature table to always be treated as absent. Consequently, a CPU whose matching signature+platform pair appears only in an image's extended signature table was never matched during early loading, and its microcode update was not applied. The kernel reports "CPU microcode: no matching
update found" in this case.

Late loading via cpucontrol(8) is not affected. There, the userland matcher parses extended signature tables correctly.

III. Impact

On affected Intel CPUs, early loading applies no microcode update even when a suitable update is present in the loaded file. Such systems run with only
the microcode installed by the system firmware (BIOS/UEFI), which may be
older than the packaged update and may lack functional or security-related errata fixes. At the time of writing, 19 CPU signatures / 58 signature+platform combinations in the packaged Intel microcode are affected, spanning various Alder Lake, Raptor Lake, Sapphire Rapids, and Emerald Rapids steppings, as well as some newer Intel Core Ultra client processors.

To determine whether your system is affected, run the following commands as root:

# kldload -n cpuctl
# cpucontrol -i 0x01 /dev/cpuctl0

If the first hexadecimal value (the CPUID signature) appears in the
following list, the system is affected by the bug.

0x000806f4
0x000806f5
0x000806f6
0x000806f7
0x00090675
0x000906a4
0x000b0674
0x000b06a3
0x000b06a8
0x000b06f2
0x000b06f5
0x000b06f6
0x000b06f7
0x000c0652
0x000c0664
0x000c06a2
0x000c06c2
0x000c06c3
0x000c06f1

Note, for signature 0x000906a4, only systems with platform ID 7 are
affected. These report 0x001c0000 as the first value in the output of "cpucontrol -m 0x17 /dev/cpuctl0".

Systems whose CPU signature matches an image's primary header, and all
AMD systems, are unaffected.

IV. Workaround

Use late loading instead of, or in addition to, early loading. Install both sysutils/cpu-microcode-intel and sysutils/cpu-microcode-rc and enable the service:

# sysrc microcode_update_enable="YES"
# service microcode_update start

V. Solution

Upgrade your system to a supported FreeBSD stable or release / security
branch (releng) dated after the correction date, and reboot the system.

Perform one of the following:

1) To update your system installed from base system packages:

Systems running a 15.0-RELEASE or later version of FreeBSD on the amd64 or arm64 platforms, which were installed using base system packages, can be updated via the pkg(8) utility:

# pkg upgrade -r FreeBSD-base
# shutdown -r now

2) To update your system installed from binary distribution sets:

Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms which were not installed using base system packages can be updated via the freebsd-update(8) utility:

# freebsd-update fetch
# freebsd-update install
# shutdown -r now

3) To update your system via a source code patch:

The following patches have been verified to apply to the applicable
FreeBSD release branches.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch https://security.FreeBSD.org/patches/EN-26:20/microcode.patch
# fetch https://security.FreeBSD.org/patches/EN-26:20/microcode.patch.asc
# gpg --verify microcode.patch.asc

b) Apply the patch. Execute the following commands as root:

# cd /usr/src
# patch -E -p0 < /path/to/patch

c) Recompile your kernel as described in <URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
system.

VI. Correction details

This issue is corrected as of the corresponding Git commit hash in the following stable and release branches:

Branch/path Hash Revision
- ------------------------------------------------------------------------- stable/15/ 2a1eaaf331f7 stable/15-n283974 releng/15.1/ a0e96483e2ce releng/15.1-n283597 releng/15.0/ 4a66af1ce037 releng/15.0-n281100 stable/14/ 38cbd2588f0b stable/14-n274496 releng/14.4/ c905b341204e releng/14.4-n273756
- -------------------------------------------------------------------------

Run the following command to see which files were modified by a
particular commit:

# git show --stat <commit hash>

Or visit the following URL, replacing NNNNNN with the hash:

<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>

To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:

# git rev-list --count --first-parent HEAD

VII. References

<URL:https://reviews.freebsd.org/D57209>

The latest revision of this advisory is available at <URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-26:20.microcode.asc> -----BEGIN PGP SIGNATURE-----

iQJPBAEBCgA5FiEEthUnfoEIffdcgYM7bljekB8AGu8FAmqN3XAbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMCwzAAoJEG5Y3pAfABrvse4P/isqmBRUFLLUnVFS/AD7 Wlg20e54L4CRORCqhL1p33WdcKs6bHg7Tgvutwy23HmX9ISrOanm5WkFq2qN16qc olNJDvlXHLeIseDH6WQrxWiBooYqqJpLOJyolqB+R0TIGRvRMidbdM24gHyOCWST MvraPYkqkQH9DSO1CYUHoLTcVLek/l9ux1p2WApHSqOw7GPcltiYUnyvKrOqBxYs DD4n0GIw0JfsXK1L9MLXJILjROUpItDHnv1CsG8VVaWQI0c+5826dTVoFsDQ1RUc mcIiBiWP/gmKxl48wzjq9qZccGN2vHMLrFYA0Zu/syqpB2g5b0zQbm9iKIak+YIJ mKHTUGAZ0YJpQAXf8f1q+pED91Veh9k0fIvnSwsDa2dfgk2XMfZeWIyHbddxS0p6 fvnCroT4sMvequ2wpC64jpebASmwjiZYYY9gPk2TdgOlu83PnYUkMbT4gv5RHgIo qwK7WQ2bDO3GaRHGQ3Zfo/Dl97bGg6KDDZZEbFOBv9hWu2bKgmLMvo2HtgKGGLDa UBGypDYWC0abbtbaqTBFtJsvUbcpf6llG/lJT6YaipVrqBjLyNFJhETS1zNIQQSr Y8pvUc+tsqlLmrI4AaqcvIwC0OY6ATppQ49ZMpujaDf3nj9wG9vw6d1l12kIWjEE 0XE3NnDLvAne7G2cC+ktwGzB
=KmJ4
-----END PGP SIGNATURE-----


--- PyGate Linux v1.5.19
* Origin: Dragon's Lair, PyGate NNTP<>Fido Gate (3:633/10)