How to Install or Update Intel and AMD CPU Microcode on Linux

Updated: 28 September 2026 · Applies to: microcode_ctl and linux-firmware on AlmaLinux and Rocky Linux 9 and 10 and RHEL 9 and 10; intel-microcode and amd64-microcode on Ubuntu 24.04 and 26.04 and Debian 13 (physical x86_64 servers)

Processor microcode is small firmware inside the CPU. Intel and AMD release updates to fix bugs and security problems such as Spectre-type vulnerabilities. Linux loads the newest microcode early at every boot, so keeping it current is a matter of updating a package and rebooting. This applies to physical servers: on a VPS, the microcode is the host's job and you cannot change it.

1. See the current microcode

grep -m1 microcode /proc/cpuinfo
journalctl -k -b | grep -i microcode

The first line shows the revision in use. The kernel log shows whether an update was applied at boot, for example "updated early: 0x2b000603 -> 0x2b000639".

2. Update it: AlmaLinux, Rocky Linux and RHEL

Intel microcode comes in the microcode_ctl package and AMD microcode in linux-firmware; both are installed by default on physical servers.

dnf upgrade microcode_ctl linux-firmware
reboot

The package update rebuilds the initramfs with the new microcode, and the reboot loads it.

3. Update it: Ubuntu and Debian

apt install intel-microcode     # Intel CPUs
apt install amd64-microcode     # AMD CPUs
reboot

On Debian, these packages are in the non-free-firmware section, which the Debian 12 and 13 installers enable by default. Later updates arrive with apt upgrade.

4. Check after the reboot

Run the commands from step 1 again: the revision should be the new one. To see which CPU vulnerabilities the kernel considers mitigated:

grep -r . /sys/devices/system/cpu/vulnerabilities/

Loading without a reboot

Loading microcode while the system runs ("late loading") is possible in some cases but not recommended by the kernel developers, and it is disabled in many current kernels. Plan a reboot instead.

BIOS updates

Server vendors also ship microcode inside BIOS or UEFI firmware updates, which apply even before Linux starts. On a rented dedicated server, contact support before flashing firmware yourself: a failed update can leave the server unable to boot, and the provider may already have a tested version.

Official documentation: The Linux microcode loader (kernel documentation).