Reference page — cumulative record through Thursday, October 8, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2021-39298
AMD 2nd Gen EPYC — A potential vulnerability in AMD System Management Mode (SMM) interrupt handler may allow an attacker with high privileges to access the …
AV AC PR UI S C I A CVSS EPSS %ile KEV
L L L N C H H H 8.8 .0044 36.6 —
AFFECTED
Product Versions Fixed
2nd Gen EPYC Various – —
3rd Gen EPYC various – —
Ryzen 2000 Series various – —
Ryzen 3000 Series Various – —
Ryzen 5000 Series various – —
TIMELINE
Aug 19 Reserved by AMD
Feb 16 Published (CNA: AMD)
Oct 7 RESCORED — CVE-2021-39298 (AMD 2nd Gen EPYC). CVSS 6.5 → 8.8 (NVD).
Description
A potential vulnerability in AMD System Management Mode (SMM) interrupt handler may allow an attacker with high privileges to access the SMM resulting in arbitrary code execution which could be used by malicious actors to bypass security mechanisms provided in the UEFI firmware.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| August 19, 2021 | Reserved | Reserved by AMD |
| February 16, 2022 | Published | Published (CNA: AMD) |
| October 7, 2026 | RESCORED | RESCORED — CVE-2021-39298 (AMD 2nd Gen EPYC). CVSS 6.5 → 8.8 (NVD). |
Affected
Affected products and packages — 5 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| AMD | 2nd Gen EPYC | — | Various | — |
| AMD | 3rd Gen EPYC | — | various | — |
| AMD | Ryzen 2000 Series | — | various | — |
| AMD | Ryzen 3000 Series | — | Various | — |
| AMD | Ryzen 5000 Series | — | various | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2021-39298 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Thursday, October 8, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
