Three PCIe Encryption Weaknesses Expose PCIe 5.0+ Systems to Faulty Data Handling

Three IDE vulnerabilities in PCIe 5.0+ have been disclosed, with CVE-2025-9612, CVE-2025-9613 and CVE-2025-9614 describing issues such as forbidden IDE reordering, completion timeout redirection and delayed posted redirection that could expose devices to stale or incorrect data.

The flaws were uncovered by Intel employees Arie Aharon, Makaram Raghunandan, Scott Constable, and Shalini Sharma and are described as affecting the IDE mechanism introduced by the IDE Engineering Change Notice in PCIe Base Specification Revision 5.0 and onwards, according to PCI-SIG.

PCI-SIG notes that successful exploitation could undermine confidentiality, integrity and overall security objectives of IDE, though attacks would require physical or low-level access to the PCIe IDE interface, making them low-severity bugs (CVSS v3.1 score: 3.0; CVSS v4 score: 1.8).

In an advisory, CERT Coordination Center urged manufacturers to follow the updated PCIe 6.0 standard and apply the Erratum #1 guidance to IDE implementations, with Intel and AMD publishing alerts listing affected products such as Intel Xeon 6 Processors with P-cores and AMD EPYC 9005 Series Processors. End users are advised to apply firmware updates from system or component suppliers, particularly in environments that rely on IDE to protect sensitive data.