Side-channels Related to the x86 PREFETCH Instruction
Priority LOW 22CWE-208Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-208.
Summary
A timing and power-based side channel attack leveraging the x86 PREFETCH instructions on some AMD CPUs could potentially result in leaked kernel address space information.
Why it matters now
EPSS 0.00327 25th percentileScored 2026-11-07
Fix Fixed All supported processors (AMD): undefined
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AMD | All supported processors | before undefined | undefined | Patch available | CNA |
- All supported processors VendorAMD Affected before undefined Fixed in undefined Patch available CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:amd:athlon_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:athlon:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:athlon_pro_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:athlon_pro:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:epyc_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:epyc:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
| cpe:2.3:o:amd:ryzen_pro_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | AMD |
| cpe:2.3:h:amd:ryzen_pro:-:*:*:*:*:*:*:* | not specified by NVD | Running on | AMD |
- cpe:2.3:o:amd:athlon_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:athlon:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:athlon_pro_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:athlon_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:epyc_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:epyc:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
- cpe:2.3:o:amd:ryzen_pro_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·AMD
- cpe:2.3:h:amd:ryzen_pro:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·AMD
Remediation
- Fix · CNA All supported processors (AMD) Fixed in undefined
Timeline
- 2026-10-02 Threatist record created from CVE-2021-26318
- 2026-10-03 Alias added: GHSA-8rf7-vpj6-3967
References
Sources
- CVE-2021-26318 · CVE Program
- CVE-2021-26318 · NVD
- FIRST EPSS
- GHSA-8rf7-vpj6-3967 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences