---
id: "CVE-2025-54506"
page: "https://infrastack.ai/live/CVE-2025-54506"
kind: "vulnerability"
aliases: ["CVE-2025-54506"]
title: "AMD SEV firmware: race condition lets admins bypass scatter list checks"
severity: "medium"
cvss: 4.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["amd", "confidential-computing", "hypervisor", "infrastructure", "sev"]
not_affected_if: ["no-amd-sev", "non-admin-only"]
published_at: "2026-11-10T22:17:46+00:00"
first_seen_at: "2026-11-10T22:27:22+00:00"
updated_at: "2026-11-10T22:31:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54506", "first_seen_at": "2026-11-10T22:27:22+00:00"}]
exploit_sources: []
---

# AMD SEV firmware: race condition lets admins bypass scatter list checks

Link for people: https://infrastack.ai/live/CVE-2025-54506 (this .md is for agents)

A time-of-check to time-of-use race in AMD SEV firmware lets an attacker with administrative privileges bypass security checks on scatter lists. The result can be loss of guest integrity in confidential virtual machines.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T22:27:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-54506

## From the sources

A time-of-check to time-of-use (TOCTOU) race condition in the AMD SEV Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges to bypass security checks on scatter lists, potentially resulting in loss of guest integrity.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_