Debian intel-microcode updates DSA-6030-1 and DSA-5924-1: Intel CPU fixes and how to apply them

Debian ships Intel's CPU microcode in the intel-microcode package. Two security advisories updated it in 2025: DSA-5924-1 on 23 May 2025 for Debian 12 (bookworm), and DSA-6030-1 on 22 October 2025 for bookworm and Debian 13 (trixie). Microcode is loaded into the processor at every boot, so these updates only matter on machines with Intel CPUs, and they take effect after a reboot.

At a glance

What the vulnerabilities are

DSA-6030-1 provides, in Debian's words, "mitigations for security vulnerabilities which could result in privilege escalation or denial of service". Intel's descriptions show that most of the nine CVEs concern Xeon server processors, several only when SGX or TDX is in use, and many require a local user who is already privileged. The highest-rated, CVE-2025-20109, is an isolation flaw in the stream cache of some Intel processors that may allow an authenticated local user to escalate privileges.

DSA-5924-1 addresses Indirect Target Selection (ITS, CVE-2024-28956) and Branch Privilege Injection (CVE-2024-45332), two transient-execution issues that may expose sensitive information to a local user (Intel CVSS 3.1 5.6 each). Debian noted that full ITS mitigation also needed the Linux kernel update released separately, so keep the kernel current as well.

None of these CVEs is in the CISA Known Exploited Vulnerabilities catalog.

Are you affected?

Only systems with Intel processors use this package. Check the CPU, the package and the microcode revision the kernel loaded:

grep -m1 'model name' /proc/cpuinfo
dpkg-query -W -f='${Package} ${Version}\n' intel-microcode
apt policy intel-microcode
grep -m1 microcode /proc/cpuinfo
sudo journalctl -b -k | grep 'microcode:'

The last command shows whether the kernel applied a microcode update early in the current boot. Microcode is applied to the physical processor. If your Debian system is a virtual machine, the physical CPU is managed by whoever runs the host, so ask them how host microcode and BIOS updates are handled.

How to update

The package lives in non-free-firmware, so that component must be enabled in your APT sources. Then:

sudo apt update
sudo apt install --only-upgrade intel-microcode
apt policy intel-microcode

Debian has since released a newer microcode version through stable point releases (3.20251111.1 builds for both releases), which includes these fixes. The tracker also lists several newer Intel CVEs as open and postponed for bookworm and trixie, meaning a fix is expected in a later update rather than an urgent DSA. AMD systems use the separate amd64-microcode package.

Restart or reboot?

Reboot. The package README explains that on a default Debian system (Debian kernel, GRUB and initramfs-tools) the update is applied in "early mode" from the initramfs during boot. The README also describes a manual reload without a reboot but warns it is no longer safe in general, so do not use it on production servers.

If a machine misbehaves after a microcode update, which the README calls very rare, you can boot once with the kernel parameter dis_ucode_ldr to skip loading it, then remove or downgrade the package.

Sources

• security-tracker.debian.org/tracker/DSA-6030-1
• lists.debian.org/debian-security-announce/2025/msg00196.html
• debian.org/security/2025/dsa-6030
• security-tracker.debian.org/tracker/DSA-5924-1
• lists.debian.org/debian-security-announce/2025/msg00087.html
• debian.org/security/2025/dsa-5924
• security-tracker.debian.org/tracker/source-package/intel-microcode
• cve.org/CVERecord?id=CVE-2025-20109
• cve.org/CVERecord?id=CVE-2025-22889
• cve.org/CVERecord?id=CVE-2024-28956
• cve.org/CVERecord?id=CVE-2024-45332
• wiki.debian.org/Microcode
• sources.debian.org/data/non-free-firmware/i/intel-microcode/3.20251111.1~deb13u1/debian...
• cisa.gov/known-exploited-vulnerabilities-catalog