Certain consumer and workstation motherboards from ASRock, ASUS, GIGABYTE, and MSI are impacted by a UEFI firmware flaw that can leave systems open to early-boot direct memory access (DMA) attacks—even when the BIOS claims protections are enabled.
The issue centers on pre-boot DMA protection, a security feature meant to stop DMA-capable peripherals (like malicious PCIe devices) from reading or tampering with system memory before the operating system has a chance to load its own defenses. In affected firmware builds, the platform may report that DMA protection is active, while failing to correctly initialize and enable the IOMMU during the most critical part of boot.
That mismatch creates a brief but dangerous window: an attacker with physical access and a DMA-capable device could potentially inspect or modify memory before OS-level safeguards are established—undermining the integrity of the boot process.
What the vulnerability enables
During early boot, firmware is responsible for setting up hardware isolation. IOMMU is one of the key mechanisms used to restrict what peripherals can access in memory. If it isn’t enabled early enough (or at all), rogue peripherals can perform DMA transactions against system memory.
In practical terms, successful exploitation could allow a physically present attacker to:
- Read sensitive data that happens to be in memory during boot
- Modify memory contents before the OS kernel loads
- Potentially inject pre-boot code or influence the system’s initial state in ways that are difficult to detect later
CVEs and affected vendors
The early-boot DMA protection bypass is tracked under four CVEs, each tied to specific motherboard vendors and chipset families:
ASRock: CVE-2025-14304
A UEFI behavior issue affecting ASRock, ASRock Rack, and ASRock Industrial motherboards on Intel 500, 600, 700, and 800 series chipsets.
ASRock has indicated that firmware updates for 600/700/800-series platforms are available, while 500-series updates are still in progress.
ASUS: CVE-2025-11901
Affects ASUS motherboards across Intel Z490, W480, B460, H410, Z590, B560, H510, Z690, B660, W680, Z790, B760, and W790 chipset families.
While the practical outcome is still tied to early-boot DMA exposure, the CVE record’s classification differs from the other vendor entries—so it’s best to treat it as an ASUS-specific implementation issue that can contribute to the same “DMA protection appears enabled” gap.
GIGABYTE: CVE-2025-14302
Impacts a wide range of GIGABYTE boards, including:
- Intel: Z890, W880, Q870, B860, H810, Z790, B760, Z690, Q670, B660, H610, W790
- AMD: X870E, X870, B850, B840, X670, B650, A620, A620A, TRX50
GIGABYTE notes that a fix for TRX50 is planned for Q1 2026.
MSI: CVE-2025-14303
Affects MSI motherboards using Intel 600 and 700 series chipsets.
How serious is it?
The CVEs have been scored as High under CVSS v4 (base 7.0). Some vendor advisories and downstream trackers also reference a CVSS v3.1 score of 6.8, which can look lower on paper but still represents a meaningful physical-access risk—especially in environments where you can’t fully control who can touch the hardware.
Why Riot Games flagged this as a real-world threat
Researchers Nick Peterson and Mohamed Al-Sharifi of Riot Games disclosed the flaw and highlighted how it could be abused beyond typical enterprise threat models—particularly by sophisticated hardware-based cheats.
Riot described the problem as a “Sleeping Bouncer” scenario: security settings suggest the guard is on duty, but in the earliest seconds of boot the underlying enforcement (IOMMU initialization) isn’t actually in place. That brief gap can be enough for a well-equipped attacker to inject or alter code before the OS can activate its own security controls.
While Riot framed the impact through the lens of competitive gaming and anti-cheat efforts, the risk extends to any scenario where an attacker can gain physical access to a machine and attach a DMA-capable device.
What to do next
Vendors are shipping (or planning) firmware updates to correct the IOMMU initialization sequence and ensure DMA protections are enforced throughout the boot process. If your motherboard is on the affected list, updating BIOS/UEFI firmware should be treated as a priority—particularly for systems in shared spaces, labs, offices, tournaments, repair environments, or anywhere physical access isn’t tightly controlled.
More broadly, the incident is a reminder that firmware security isn’t just a data center concern. IOMMU is foundational for isolation and trust in modern platforms—including virtualization-heavy environments—so correct early-boot configuration matters even on machines that “aren’t servers.”