AMD Quietly Disabled Ryzen's Memory Encryption in a BIOS Update

A Linux user's routine check uncovered something alarming: AMD has been silently disabling TSME (Transparent Secure Memory Encryption) on consumer Ryzen CPUs through BIOS updates. While the BIOS option still shows 'Enabled,' the encryption never actually activates. AMD's official response? 'TSME is PRO-only technology.' But the feature had been working on consumer chips for years before being quietly removed — and Windows users have no way to even know it's gone.

💡 What You Will Learn

A Linux user's routine check uncovered something alarming: AMD has been silently disabling TSME (Transparent Secure Memory Encryption) on consumer Ryzen CPUs through BIOS updates. While the BIOS optio

You might have installed the latest BIOS, and your security is gone. And you'll never know.

1. A Linux User's Accidental Discovery

In April, a Linux user named Ben Kilpatrick casually checked a status code while setting up his system.

tsme_status = 0

TSME stands for Transparent Secure Memory Encryption. It's a hardware encryption engine inside AMD chips that uses the CPU's built-in AES module to automatically encrypt all data written to memory — passwords, private keys, encrypted sessions, online banking pages open in your browser. Everything in RAM is ciphertext.

This feature has been available on all AMD Ryzen CPUs since around 2020. Including the one in your machine.

Kilpatrick was using a Ryzen 7 9700X, Zen 5 architecture — not old. TSME should have been enabled. But the status code showed: disabled.

He thought it was a motherboard BIOS setting issue. He went into the BIOS, found the option — it was still there, even showing 'Enabled.' But when actually tested, the encryption wasn't working.

The BIOS option was lit up, but the encryption wasn't. That's the most insidious part.

1. Tracing It Down — AMD Playing Disappearing Act

Kilpatrick raised the issue on AMD's public GitHub engineering page. Tom Lendacky, an AMD fellow-level engineer, initially helped troubleshoot, suggesting he toggle BIOS options and contact the motherboard vendor.

But then things took a turn.

MSI's technical support later reported back: AMD had told them that TSME is only for Ryzen PRO and EPYC — regular consumer Ryzen doesn't support it.

Wait — a feature that worked for years suddenly 'doesn't support it'?

Kilpatrick did a controlled test: same ASUS X870E motherboard, same BIOS firmware, with a Ryzen 9800X3D (consumer) and a Ryzen PRO 9945 (professional). The result:

PRO processor: tsme_status = 1 (encryption enabled) Consumer processor: tsme_status = 0 (encryption disabled)

Case closed. It's not a bug — it's deliberately disabled.

More troubling: AMD has an internal flag called DfIsTsmeEnabled. On consumer chips it reads FALSE. On PRO/EPYC it reads TRUE. AMD refuses to answer whether this is a hardware limitation or a software policy — in other words, they don't want to explain why.

And engineer Tom Lendacky, after helping initially, left a final message: 'Sorry, I don't have any more information to share.' Then went completely silent.

1. Windows Users Are the Real Victims

Here's the most frustrating detail.

On Windows, there is absolutely no way to see whether TSME is enabled. No system notification. No Device Manager option. No log entry. Windows users simply have no way to know their security protection has been silently removed.

Linux users can at least type cat /sys/kernel/debug/amd_iommu/tsme_status to check.

Windows users? Sorry, you don't even have the right to know.

And many motherboard manufacturers (ASUS, MSI, Gigabyte) set the TSME option to 'Auto' or 'Enabled' by default in BIOS — meaning users are paying the performance penalty (TSME adds about 8ns of memory latency) without actually getting any encryption protection.

Paying for security guards who already left.

1. Does This Affect You?

If you only game, browse the web, and watch videos — honestly, TSME being disabled won't affect your daily use.

It protects against physical access attacks: someone briefly getting their hands on your machine (hotel room, shared workspace, airport security), using a Thunderbolt peripheral to DMA-read your memory, or tapping into the memory bus through debug interfaces. Without TSME, your passwords, private keys, and browser sessions in RAM are all plaintext — readable by anyone with physical access.

The average person being targeted by this kind of attack is indeed unlikely. But if you run cryptocurrency nodes, operate hardware wallets, or carry a company laptop with client data — this is a real threat boundary.

AMD's only official response: 'TSME is part of PRO Technologies and only available on PRO processors.'

This is the first time AMD has publicly stated this limitation. What they didn't say: why did it work before? Why remove it silently without explanation? Why help a user troubleshoot at first, then go radio silent?

1. Personal Take: This Is Worse Than Intel's Security Flaws

I'm not a security paranoid. But I have to say — this feels worse than the CPU vulnerabilities Intel has been dealing with over the years.

Intel's flaws (Meltdown, Spectre, and their variants) were at least discovered accidentally. Once exposed, Intel had to acknowledge them, release patches, and accept the performance hit. The whole process was transparent. Users were informed.

What did AMD do? A security feature that existed for five or six years, silently disabled via a BIOS update. No announcement. No explanation. No response. An engineer starts helping you fix it, then gets told from above to shut up.

And the reasoning doesn't hold up. You claim 'TSME is a PRO-only feature' — then why did it work on consumer chips for five years without anyone noticing it 'didn't work'? Why were AMD's own engineers confirming on GitHub in 2020 that the Ryzen 3700X 'should support TSME'?

This isn't a technical decision. It's a business segmentation move. Deliberately weakening consumer product security to widen the premium gap for PRO series.

The approach of 'let you use it first, then quietly take it away' is far more insidious than never having it at all.

1. Let's Talk in the Comments

Are you on AMD or Intel? Do you read BIOS update changelogs before updating?

Personally, I'm going to check the tsme_status on my own machines — even though it's probably already 0, at least I want to know when this line of defense was pulled.