CVE-2021-26314: AMD Speculative execution with Floating-Point Value Injection

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-06-09 · updated 2026-06-17
Weakness: CWE-208

Description

Potential floating point value injection in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution with incorrect floating point results, may cause the use of incorrect data from FPVI and may result in data leakage.

Affected products

Arm Cortex-A72: all versions
Broadcom Bcm2711: all versions
Fedoraproject Fedora: 33, 34
Intel Core I7-10700K: all versions
Intel Core I7-7700K: all versions
Intel Core I9-9900K: all versions
Intel Xeon Silver 4214: all versions
xen: all versions

References

http://www.openwall.com/lists/oss-security/2021/06/09/2
http://www.openwall.com/lists/oss-security/2021/06/10/1
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H36U6CNREC436W6GYO7QUMJIVEA35SCV/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVA2NY26MMXOODUMYZN5DCU3FXMBMBOB/
https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1003
http://www.openwall.com/lists/oss-security/2021/06/09/2
http://www.openwall.com/lists/oss-security/2021/06/10/1
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H36U6CNREC436W6GYO7QUMJIVEA35SCV/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVA2NY26MMXOODUMYZN5DCU3FXMBMBOB/
https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1003

Get alerted when CVE-2021-26314 or the next vulnerability affects your stack