Search: CVE-2025-21090

CVE-2025-21090 is a medium severity vulnerability affecting some Intel Xeon processors. It involves a missing reference to an active allocated resource that may allow an authenticated local user to cause a denial of service condition. The vulnerability requires local access and privileges and does not involve user interaction or network vectors.

Two new vulnerabilities affecting specific Intel processors have been identified. CVE-2025-21090 allows an unprivileged actor using the AMX and AVX CPU instructions to render the host machine inoperative. CVE-2025-22840 allows an unprivileged actor using the prefetchit CPU instruction to access memory contents without authorization, potentially leading to remote code execution. Google has stated no customer action is required as they will update systems during planned maintenance windows. No evidence of exploitation has been reported.