VyOS and CPU microcode updates?

General questions
1

Looking at VyOS Stream 2026.03 there are microcode packages installed for both AMD64 and Intel CPUs:

vyos@vyos:~$ dpkg -l | grep -i microcode
ii  amd64-microcode                  3.20250311.1~deb12u1                     amd64        Platform firmware and microcode for AMD CPUs and SoCs
ii  intel-microcode                  3.20251111.1~deb12u1                     amd64        Processor microcode firmware for Intel CPUs
ii  iucode-tool                      2.3.1-3                                  amd64        Intel processor microcode tool

The kernel itself is compiled with:

CONFIG_MICROCODE=y
# CONFIG_MICROCODE_LATE_LOADING is not set

However at the same time there are also these files in /etc/modprobe.d (which doesnt seem to exist at VyOS Networking Platform · GitHub so I assume they came along with some debian package?):

vyos@vyos:~$ cat /etc/modprobe.d/amd64-microcode-blacklist.conf 
# The microcode module attempts to apply a microcode update when
# it autoloads.  This is not always safe, so we block it by default.
blacklist microcode
vyos@vyos:~$ cat /etc/modprobe.d/intel-microcode-blacklist.conf 
# The microcode module attempts to apply a microcode update when
# it autoloads.  This is not always safe, so we block it by default.
blacklist microcode

Also confirmed that the blacklist-files comes with the microcode packages themselves:

Wouldnt above mean that the microcode updates are actually never applied?

Im running VyOS virtualized so I doubt it would be applied anyway, also sudo dmesg | grep -i microcode gives 0 hits in return.

I have seen some claims that having microcode enabled in kernel will autoload found firmware updates so the above blacklist is to block from “late” updates but can anyone confirm this (as in it wont affect actually updates of the microcode during boot)?

There is like not a single word about this over at:

2

I just checked and it seems to be loaded during boot. See:

root@br1:~# journalctl -k -b|grep -i microcode
Aug 10 16:40:46 localhost.localdomain kernel: microcode: Current revision: 0x05003901
Aug 10 16:40:46 localhost.localdomain kernel: microcode: Updated early from: 0x0500320a
Aug 10 16:40:46 localhost.localdomain kernel: microcode: Microcode Update Driver: v2.2.
root@br1:~#

This shows it updated from 0x0500320a to 0x05003901 during boot.

3

Thanks!

It turns out that the block in modprobe should be there to avoid “late loading” of the microcode updates since they normally only work for “early loading” during boot.