Critical PCIe 6.0 Flaws Risk Secure Data Integrity via Stale Data Injection in IDE Mechanism

On 11 December 2025, CERT Coordination Center (CERT/CC) warned of three specification-level flaws in PCIe 6.0’s IDE mechanism that could let attackers with local access inject stale or corrupted data into secure data streams, potentially undermining data integrity. The vulnerabilities, tracked as CVE-2025-9612, CVE-2025-9613 and CVE-2025-9614, relate to re-ordering PCIe traffic, improper flushing of timeouts, and issues with re-keying or flushing streams, respectively.

Although exploitation is not possible remotely over the Internet, the advisory notes that under certain traffic patterns at the PCIe interface, a receiver could process stale or incorrect data. PCI-SIG has issued a Draft Engineering Change Notice titled “IDE TLP Reordering Enhancement,” to be incorporated into the PCIe Base Specification Rev 7.0 and future versions.

For affected hardware, the fix is in firmware, with guidance that vendors supporting PCIe 5.0 IDE should apply corrections and updated test procedures, and end users should install firmware updates where data integrity is critical.