AMD Ionic Cloud Driver Vulnerabilities Affecting VMware ESX (CVE-2025-62623, CVE-2025-62624, CVE-2025-62627)

AMD Ionic Cloud Driver Vulnerabilities Affecting VMware ESX (TL-2026-2146) is a high-severity software vulnerability scored CVSS 8.8, first published 2026-08-25. It has no confirmed attribution, affects AMD Pensando DPU ionic cloud driver for VMware ESX, references 3 CVEs (CVE-2025-62623, CVE-2025-62624, CVE-2025-62627), maps to 9 MITRE ATT&CK techniques (T1005, T1082, T1199), and is covered by 9 detection rules and 16 indicators of compromise.

Key facts for TL-2026-2146

Threat ID
TL-2026-2146
Severity
HIGH
CVSS
8.8 (CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-08-25
Last reviewed
2026-08-25
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, cloudhosting
Target regions
Global
Detection rules
9
Indicators of compromise
16

Malware and tooling in AMD Ionic Cloud Driver Vulnerabilities Affecting VMware ESX

Malware and tooling: pensando/dsc-drivers (GitHub repository)

AMD and VMware disclosed three vulnerabilities in AMD's ionic cloud driver for VMware ESX hosts using AMD-Pensando DPU hardware, reported through the AMD Bug Bounty Program. CVE-2025-62623 and CVE-2025-62624 are heap-based buffer overflows enabling privilege escalation and potential arbitrary code execution; CVE-2025-62627 is an untrusted pointer dereference letting an unprivileged guest VM read hypervisor kernel memory or co-located guest VM memory, breaking tenant isolation.

How AMD Ionic Cloud Driver Vulnerabilities Affecting VMware ESX works

AMD and VMware jointly disclosed three vulnerabilities in the AMD ionic cloud driver -- the kernel-mode component in VMware ESXi that services AMD-Pensando Distributed Services Card (DPU/SmartNIC) hardware -- affecting ESXi 8.x and 9.x hosts. All three were reported to AMD through its Bug Bounty Program by researcher Ori Nimron (@orinimron123). CVE IDs were reserved on 2025-10-16, well before the coordinated public disclosure on 2026-05-12, indicating a multi-month private remediation window between AMD, VMware/Broadcom, and the researcher. The vulnerabilities are documented in AMD Security Bulletin AMD-SB-2001, referenced from a VMware Security Blog post published the same day as initial disclosure.

CVE-2025-62623 (CWE-119, Improper Restriction of Operations within the Bounds of a Memory Buffer) and CVE-2025-62624 (CWE-122, Heap-based Buffer Overflow) are both heap-based buffer overflows in the ionic driver. Both carry an identical CVSS 4.0 vector (AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, base score 8.8): exploitation requires local access and only low privileges -- consistent with an attacker who already has code execution inside a guest VM on the affected host -- with no user interaction, though attack complexity is high. Successful exploitation could let that attacker perform operations beyond the intended memory buffer boundaries, escalate privileges, and potentially execute arbitrary code on the ESXi host itself, breaking out of the guest VM's intended boundary through the DPU driver interface. Both vulnerability-impact and subsequent-system-impact metrics (VC/VI/VA and SC/SI/SA) are rated High, reflecting total confidentiality, integrity, and availability compromise of the host, not just the guest.

CVE-2025-62627 (CWE-822, Untrusted Pointer Dereference, CVSS 4.0 7.2, vector AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H) is an untrusted pointer dereference in the same driver: it dereferences a pointer that originates from, or is influenced by, an untrusted source without validating that the pointer references memory the caller is permitted to access. An attacker operating within an unprivileged guest VM issues crafted requests to the ionic driver interface to induce reads of arbitrary kernel addresses or addresses mapped to neighboring guests. This directly undermines the tenant-isolation guarantee that multi-tenant virtualization depends on: a low-privileged tenant VM could read hypervisor kernel memory or memory contents belonging to a separate, higher-value tenant's VM on the same physical host. The vector's VA:H/SA:H components also indicate a meaningful availability impact (e.g., driver/host crash from an invalid dereference), not just confidentiality loss.

None of the three CVEs appear in the CISA Known Exploited Vulnerabilities catalog as of 2026-08-25, and no public proof-of-concept or exploit code has been identified; CISA's SSVC assessment (ADP v2.0.3, recorded 2026-05-13) rates CVE-2025-62627's exploitation status as 'none', the attack as not automatable, and technical impact as 'partial'; the CVE carries an EPSS score of 0.00097 (0.797th percentile) -- a very low probability of near-term exploitation. CVE-2025-62623 independently shows an EPSS of roughly 0.02%, consistent with the same assessment. The vulnerabilities surfaced through responsible disclosure via AMD's bug bounty program rather than in-the-wild observation. On 2026-05-14, Red Hat Product Security separately assessed the ionic-driver CVEs and determined they do not affect any currently supported Red Hat product, since the vulnerable component is specific to VMware ESXi's driver integration rather than the upstream/mainline Linux kernel.

The 'ionic' driver name traces to AMD-Pensando's open-source out-of-tree driver family published at github.com/pensando/dsc-drivers, which packages three related kernel modules -- ionic/ionic_mnic (the network interface driver, with a separate PCI-bus build for standard hosts and a platform-bus 'mnic' build for the DSC's internal Arm complex), mnet (ioctl-based network-port management), and mnet_uio_pdrv_genirq (a UIO interface for userspace I/O). VMware ESXi ships its own in-tree adaptation of this driver family as the vulnerable 'ionic cloud driver'; the affected DPU hardware spans AMD's full current Distributed Services Card lineup -- DSC-25 (dual-port 25G), DSC-100 (dual-port 100G), DSC2-200 (dual-port 200G), and DSC3-400 (dual-port 400G).

AMD and VMware recommend remediation via VMware ESXi 8.0U3i (bundled in VMware Cloud Foundation 5.2.3.0) or VMware Cloud Foundation 9.0.2, both of which include the fix; no interim workaround has been published. Because AMD-Pensando DPUs are deployed specifically in shared, multi-tenant ESXi environments using SmartNIC offload, practical exposure concentrates in cloud hosting providers and enterprises running dense multi-tenant ESXi clusters on this hardware.

MITRE ATT&CK techniques used in TL-2026-2146

Collection

T1005 Data from Local System

Discovery

T1082 System Information Discovery; T1580 Cloud Infrastructure Discovery

Initial Access

T1199 Trusted Relationship

Impact

T1499.004 Application or System Exploitation

Resource Development

T1583.003 Virtual Private Server; T1588.006 Vulnerabilities

Reconnaissance

T1592.004 Client Configurations

Privilege Escalation

T1611 Escape to Host

Affected products and versions in AMD Ionic Cloud Driver Vulnerabilities Affecting VMware ESX

  • AMD — Pensando DPU ionic cloud driver for VMware ESX
    Vulnerable versions: ESXi 8.x with AMD-Pensando DPU; ESXi 9.x with AMD-Pensando DPU
    Fixed in: ESXi 8.0U3i (VMware Cloud Foundation 5.2.3.0); VMware Cloud Foundation 9.0.2
  • Broadcom (VMware) — VMware ESXi / ESX
    Vulnerable versions: 8.x; 9.x
    Fixed in: 8.0U3i

Remediation for AMD Ionic Cloud Driver Vulnerabilities Affecting VMware ESX

Patches

  • Update to VMware ESXi 8.0U3i, included in VMware Cloud Foundation (VCF) 5.2.3.0.
  • Alternatively update to VMware Cloud Foundation (VCF) 9.0.2.

Immediate actions

  • Inventory ESXi 8.x/9.x hosts that use AMD-Pensando DPU (Distributed Services Card) hardware -- DSC-25, DSC-100, DSC2-200, or DSC3-400 -- to determine exposure.
  • Given the tenant-isolation-breaking nature of CVE-2025-62627, restrict co-tenancy of untrusted or lower-trust VMs on unpatched hosts with AMD-Pensando DPUs until patched.
  • Per third-party analysis (SentinelOne), monitor vmkernel.log on affected hosts for ionic driver fault entries and correlate them with guest-VM activity to detect possible exploitation attempts pending patch deployment.

Workarounds

  • AMD and VMware have published no official workaround and direct customers to apply the fixed ESXi/VCF releases.
  • Third-party guidance (SentinelOne) suggests interim compensating controls where patching is delayed: disable the ionic driver on hosts where the AMD-Pensando DPU network path is not in active use, migrate higher-trust/sensitive tenant workloads off unpatched shared hosts, and enforce stricter tenant-segregation policies until the fix is applied.

Longer-term hardening

  • Establish a patch cadence for DPU/SmartNIC firmware and host drivers alongside standard ESXi patching, since these components sit outside the typical hypervisor update path.
  • Monitor AMD Product Security bulletins (AMD-SB-*) and VMware/Broadcom Security Advisories for further DPU-related driver disclosures.

CVEs associated with AMD Ionic Cloud Driver Vulnerabilities Affecting VMware ESX

CVE-2025-62623, CVE-2025-62624, CVE-2025-62627

Weaknesses (CWE) in AMD Ionic Cloud Driver Vulnerabilities Affecting VMware ESX

CWE-119, CWE-122, CWE-822

Timeline of AMD Ionic Cloud Driver Vulnerabilities Affecting VMware ESX

  • MITRE reserves CVE-2025-62623, CVE-2025-62624, and CVE-2025-62627 for AMD following the researcher's report through the AMD Bug Bounty Program, beginning a private coordinated-disclosure window of roughly seven months.
  • AMD publishes Security Bulletin AMD-SB-2001 and VMware simultaneously publishes a security blog post disclosing the three ionic cloud driver vulnerabilities for ESX hosts with AMD-Pensando DPU hardware.
  • NVD publishes CVE-2025-62623, CVE-2025-62624, and CVE-2025-62627 with CVSS v4.0 base scores of 8.8, 8.8, and 7.2 respectively; CISA's SSVC assessment (ADP v2.0.3) is recorded the same day, rating CVE-2025-62627's exploitation status as 'none', the attack as not automatable, and technical impact as 'partial'.
  • Red Hat Product Security assesses the ionic-driver CVEs and determines they do not affect any currently supported Red Hat product, since the vulnerable component is VMware ESXi's driver integration rather than upstream Linux.
  • NVD/CVE-record updates finalize for all three CVEs, formally closing the initial publication cycle.
  • SentinelOne publishes a vulnerability database entry analyzing CVE-2025-62627's untrusted pointer dereference and its impact on tenant isolation between co-located guest VMs.
  • AMD updates Security Bulletin AMD-SB-2001 with revised guidance after initial publication.
  • NVD last-modifies all three CVE records; entries remain marked 'awaiting analysis' pending a full CNA/NIST CVSS assessment.

Sources cited for AMD Ionic Cloud Driver Vulnerabilities Affecting VMware ESX

Threats related to AMD Ionic Cloud Driver Vulnerabilities Affecting VMware ESX

Detection coverage for TL-2026-2146

As of 2026-08-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2146 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats