Official announcement: November 11, 2025

Preface: AMD EPYC processors support an Input-Output Memory Management Unit (IOMMU), a hardware component essential for managing memory access for peripheral devices. IOMMU technology on EPYC platforms is a critical component for virtualization, device passthrough (PCIe passthrough), and system security.

Background: SEV-SNP mitigates many TLB (Translation Lookaside Buffer) attacks by having the CPU hardware perform automatic TLB flushes to maintain consistency between the TLB and the guest’s memory mappings, preventing a malicious hypervisor from poisoning a VM’s TLB. In contrast, earlier versions of SEV (without SNP) relied on the hypervisor for TLB consistency, which created a vulnerability to TLB poisoning attacks where the hypervisor could manipulate TLB entries between processes in a VM.

AMD Reverse Page Table, also known as the Reverse Map Table (RMP), is a hardware-managed data structure used in AMD processors, particularly with SEV-SNP (Secure Encrypted Virtualization – Secure Nested Paging), to track memory page ownership and security states. It works by having a single, system-wide table where the index is the physical memory frame number, and the entry contains the virtual page number and the process ID (or other identifier) that owns it. This is different from traditional page tables, which are process-specific and indexed by virtual page numbers. 

Ref: Improper handling of invalid nested page table entries in the IOMMU may allow a privileged attacker to induce page table entry (PTE) faults to bypass RMP checks in SEV-SNP, potentially leading to a loss of guest memory integrity.

Vulnerability details: CVE-2025-29934 – A bug within some AMD CPUs could allow a local admin-privileged attacker to run a SEV-SNP guest using stale TLB entries, potentially resulting in loss of data integrity.

Official announcement: Please refer to the link for details – https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3029.html#details