Skip to main content

CISA alerts to UEFI IOMMU initialization flaw on some motherboards

Source Decision Insights Threat Desk Published December 17, 2025 Companies 2
Human View Machine View

2 companies named across 3 categories, one of 499 articles referencing Cybersecurity and Infrastructure Security Agency (CISA). Previous coverage: CISA alerts on Siemens Gridscale X Prepay vulnerabilities (Dec 2025).

Companies mentioned

Best suited for

Seniority
Analyst
Job function
Cybersecurity / Information Security
Persona
Security Architect
Buyer role
Technical Implementer / Administrator
Decision stage
Post Buy
Adoption curve
Early Majority
Industry
Information Technology / Technology Hardware & Equipment / Technology Hardware, Storage & Peripherals

Our classification, not the publisher's statement. Best suited for, not only for.

Some UEFI-supported motherboard models contain a firmware flaw that prevents proper IOMMU initialization, creating a pre-boot Direct Memory Access (DMA) vulnerability that allows a physically connected PCI Express (PCIe) device to read or modify system memory before Operating System (OS) protections are active and enabling pre-boot code injection on systems with unpatched firmware.

The advisory lists the related identifiers CVE-2025-14303, CVE-2025-11901, CVE-2025-14304, and CVE-2025‑14302 and describes UEFI implementations that report DMA protection as enabled while failing to correctly configure and activate the Input–Output Memory Management Unit (IOMMU) during the early hand-off phase of the boot sequence, permitting a DMA-capable Peripheral Component Interconnect Express (PCIe) device with physical access to perform unauthorized memory reads or writes before the OS loads.

When the IOMMU is not properly initialized, a physically present attacker using a DMA-capable PCIe device can bypass early-boot memory protections and access or alter system memory via DMA transactions processed prior to the OS enabling its security controls.

Vendors with affected products have begun issuing firmware updates that correct the IOMMU initialization sequence and restore DMA protections during early boot; because multiple vendors are involved and fixes are being published on different schedules, customers should obtain and apply published firmware packages when they become available to address the initialization failure.

The advisory’s guidance urges users and administrators to apply the latest firmware updates as soon as they are released, to monitor the Vendor Information section for newly published advisories and updated firmware packages, and to prioritize prompt patching in environments where physical access cannot be fully controlled.

Blog post, originally published by Vijay Sarvepalli at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-alerts-to-uefi-iommu-initialization-flaw-on-some-motherboards/",
        "name": "CISA alerts to UEFI IOMMU initialization flaw on some motherboards",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-alerts-to-uefi-iommu-initialization-flaw-on-some-motherboards/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
      "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
    },
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "Analyst"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Cybersecurity / Information Security"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Architect"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Technical Implementer / Administrator"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Technology Hardware & Equipment / Technology Hardware, Storage & Peripherals"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:21:18-06:00",
    "datePublished": "2025-12-17T09:10:22-07:00",
    "description": "UEFI IOMMU vulnerability lets PCIe devices access system memory before the OS loads; vendors are issuing firmware updates.",
    "headline": "CISA alerts to UEFI IOMMU initialization flaw on some motherboards",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Vijay Sarvepalli"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/382314"
    },
    "keywords": [
      "Direct Memory Access",
      "Firmware",
      "Operating System"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-alerts-to-uefi-iommu-initialization-flaw-on-some-motherboards/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/registry/interconnect-services-bv/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/interconnect-services-bv/",
        "name": "Interconnect Services BV"
      },
      {
        "@type": "SoftwareSourceCode",
        "name": "Express"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages