Three Ryzen vulnerabilities in two months hurt performance

Every CPU security patch costs performance, and this isn't the last

Two security advisories in two months and three accumulated vulnerabilities over three years on the same processor. This tally isn't kept by a lab: it's felt by anyone with a Ryzen at home. Each alert is closed the same way, with a new BIOS, fresh AGESA firmware, and a permanent performance drop. The latest batch affects Zen 3 and Zen 4, arriving just as AMD has made clear that desktop Zen 2 chips will not receive mitigation.

What vulnerabilities plague Ryzen processors

The trickle of issues has been continuous since Spectre and Meltdown. Retbleed, which forced Linux to adopt protections Windows had used since 2018, was trinc by Inception, capable of affecting the entire range from Zen 1 to Zen 4. Then came TSA and Vmscape, which cut performance on Zen 3 and Zen 4, plus another flaw: a guest in qemu/kvm can compromise the host system via speculative execution, listing all Ryzen and Intel Coffee Lake CPUs. Early reports suggest this attack could extract disk encryption keys from the host in minutes. DDR5 memory is also vulnerable to Rowhammer-style attacks.

Severity depends on who you ask. One revelation received a CVSS score of 6.5 out of 10, placing it in medium severity. Remote exploitation without privileges, reportedly possible even through JavaScript, remains unconfirmed by real-world attacks. It is worth remembering that Spectre or Meltdown have never been exploited remotely, as far as we know.

How much performance is lost with each patch

Each mitigation adds extra instructions the processor executes before speculating. The result is measurable. A Jetstream2 test showed a 7% lower score compared to a capture from a year prior, on a machine where Meltdown protection was enabled and Speculative Store bypass disabled. AMD claims recent losses will be minimal but provides no figures before firmware release.

A 5950X bought three summers ago has accumulated three vulnerabilities hurting performance—Inception, TSA, and Vmscape—with two requiring microcode updates. Some argue disabling hyperthreading helps more with temperature than security. Others note the flaw lies in the design itself: speculative execution is the root of most issues, and abandoning it would miccionan losing half a decade of performance gains.

Zen 2 left unpatched five years later

The most troubling detail isn't the vulnerability, but the response. AMD does not plan to mitigate the latest severe flaw in desktop Zen 2 processors, which launched exactly five years ago. Owners can update for newer generations, but no new firmware awaits them. EPYC chips did receive microcode. Obsolescence stops being a metaphor and becomes a support notice.

On Linux, software covers part of the gap with the latest kernel, but desktop CPU firmware cannot be touched from the OS: it requires BIOS or AGESA updates. If the motherboard manufacturer doesn't publish them, there is nothing to do. The Steam Deck is also affected and will see reduced performance.

Vulnerabilities not fixed by software

Some flaws aren't solved with an update. A rootkit loaded before the OS that survives formatting requires hardware reprogramming of the BIOS chip or replacing the motherboard. UEFI warnings are piling up, and properly enabled Secure Boot is the only reasonable barrier against them.

Additionally, a vulnerability was discovered in MSI boards, both Intel and AMD. The only fix involves a hardware flash programmer. The brand released a new BIOS after more than a year without updating seemingly abandoned models, signaling seriousness.

Cost of staying on AM4 vs jumping to AM5

The paradox is that the older platform still makes sense price-wise. The 5900X hovers around €344, the 5800X3D at €325, and the 5800X drops to €212. 32 GB of DDR5 is now available under €100, and a second-hand Ryzen 3600 appears for €60-70. DDR4 is cheap. Building a new AM4 rig only pays off if you reuse board and RAM, though nuances remain: motherboards are still expensive.

The full price breakdown per model and comparison with switching platform costs paints an uncomfortable ladder, with the 5800X as the budget option and others paying for the X3D name or high-end label.

---

With these numbers, upgrading is cheap while patching is costly. No one has yet published exact performance losses from the latest round, nor when firmware mitigations will arrive board by board. Buyers stare at CVE lists, outdated BIOSes, and unanswered questions: if silicon was safe on purchase day, why does it stop being so every few months?