The AMD microcode seems to be outdated and insecure for AMD Ryzen 5 5560U and possibly other consumer CPUs

Ellie <[email protected]> Fri, 23 May 2025 17:17:30 +0200
Newsgroups dev.linux.lists.lvfs-general
Message-ID <[email protected]>
Dear linux firmware team,

I'm really sorry if this is the wrong place to point this out (I already 
mixed it up once, I'm not sure where exactly linux-firmware git concerns 
would go):

But it appears to be that the amd-microcode packages of various 
distributions seem to be based on 
https://git.kernel.org/?p=linux/kernel/git/firmware/linux-firmware.git;a=summary 
and that those files are outdated for AMD Ryzen 5 5560U. For me, that 
package is this one as an end user: 
https://pkgs.alpinelinux.org/package/edge/main/x86/amd-ucode

This outdated microcode situation leads to the following lscpu entry:

Spec rstack overflow:   Vulnerable: Safe RET, no microcode

The updated newer microcode is available online from other unofficial 
sources, and I applied it myself using tools that for some reason are 
only available unofficially.

But during upgrades whenever amd-microcode of my distribution comes with 
a new version, my distribution likes to overwrite my changes with the 
"update" and downgrades it again. This happens I think whenever the 
linux firmware repo amd-ucode sources are updated for any AMD cpu that 
isn't the Ryzen 5 5560U, which seems to be stuck outdated.

I've heard rumors this is somehow intended from AMD for consumer CPUs, 
e.g. talked about here:

https://www.reddit.com/r/linux/comments/15xvpfg/updating_your_amd_microcode_in_linux/

If that's true, I don't understand how that makes sense or why it 
wouldn't be preferable to update it properly, when AMD seems to have the 
microcode internally and when it can be applied manually by users anyway.

If there's a possibility this situation could be improved, that would be 
awesome. Perhaps you would know where I would best write about this? AMD 
sadly didn't seem to be able to tell me why the microcode is left 
outdated outside of BIOS updates.

I might be missing something here however, my apologies. Perhaps 
somebody here understands the big picture.

Regards,

Ellie