This BIOS is moved to Stable. If you have already updated during the beta phase, you don’t need to do further action.
Highlights
- Added support for Gen 2 HID Keyboards.
- Added support for the single-ROM BIOS Crisis Recovery feature.
- Added fingerprint reader support and power control integration.
- Fixed an issue where Battery Extender status reported incorrectly following a reboot, hibernation, or shutdown after timer expiration.
- Fixed an issue where PROCHOT# might fail to release upon entering system sleep.
- Remapped key event on input deck: F12 now sends KEY_CONFIG instead of KEY_MEDIA.
- Updated thermal tables to improve system stability.
- Updated Microcode to 0x6134.
- Updated CSME to 16.1.40.2765v3.
- Security Fixes - CVE-2025-31648, CVE-2025-27708, CVE-2025-20080, CVE-2025-32008.
You can check your current BIOS version following the steps here to determine if you are on the latest release.
Please note:
1. Upgrading to version 3.09 requires a minimum baseline of BIOS version 3.08. Updating directly from an older version will prevent the system from powering on.
2. This is a two-stage BIOS update process.
-
WIndows: Please run the 3.08 updater first, and then execute the 3.09 updater once that completes.
-
Linux: If your system is running a BIOS version lower than 3.08, LVFS will only offer version 3.08 initially. Once you complete the update to 3.08, version 3.09 will become visible in LVFS, allowing you to proceed with the final update.
-
EFI: The EFI updater will automatically detect your current BIOS version and execute the appropriate installer—running version 3.08 or 3.09 based on your system’s baseline.
3. Rollbacks from version 3.09 are permanently blocked due to an increase in the EC image size.
Subscribing to release notifications
If you want to subscribe to new release notifications you can now opt in through this link to receive an email when we release a new BIOS or driver update for your Framework Laptop.
BIOS Crisis Recovery
At the end of POST, the BIOS hands control off to your operating system. Crisis Recovery is a special alternative mode: instead of booting an OS, the BIOS looks for a firmware update file and re-flashes itself.
This lets the system repair its own firmware after a failed or corrupted BIOS flash, for example if a BIOS update was interrupted by a power loss and the machine no longer boots normally.
When To Use BIOS Crisis Recovery
Use these steps if your system fails to power on to the OS after a BIOS update, shows no display, or you were instructed to perform a BIOS recovery. If your system still boots normally, you do not need this procedure.
How Recovery Is Triggered
If the BIOS detects that its own code in flash memory has been corrupted, it automatically enters Crisis Recovery and begins searching attached storage for a recovery file. You do not need to press anything.
Prepare the Recovery Drive
On a working system:
- Insert the USB flash drive and format it as FAT32. (This erases the drive)
- On the drive, create the folder path \EFI\FWK (an EFI folder, and inside it an FWK folder).
- Copy the recovery file into that FWK folder.(The CAP file can be got from the EFI updater package) The full path should be: \EFI\FWK\Framework_Laptop_12_Intel_RPL_RECOVERY.fd (The file name is case-sensitive and must match exactly.)
- Double-check the file name is spelled exactly and with the same capitalization as shown above, ending in .fd.
- Safely eject the drive.
Perform the Recovery
On a target system:
- Power off the affected system completely.
- Insert the prepared recovery drive into a USB port on the affected system.
- If the BIOS is corrupted it may enter recovery automatically at power-on.
- The BIOS scans all attached storage (USB and NVMe) for the recovery file in \EFI\FWK, then begins re-flashing. Do not power off or remove the drive during this process. (It may take a few minutes to scan and enter the recovery.)
- Wait for the update to complete and the system to restart. The system should then boot to the operating system normally.
Important!! Once flashing begins, keep the system powered and do not remove the recovery media until the process finishes. Interrupting a BIOS flash can leave the system unbootable.
Downloads
Windows
| Download Link | SHA256 |
|---|---|
| https://downloads.frame.work/bios/Framework_Laptop_12_13th_Gen_Intel_Core_BIOS_3.09_2Stages_Updater.zip | F4FE64056031FEA3514FBA9D2D6AEDC82DD2451A6683CDB32B6330FEB1AED41D |
Instructions for Windows Installer:
- Ensure your system is plugged into power and your battery is charged.
- Extract the contents of the zip.
- Run the following updates in sequence. After each file is run your system will automatically restart.
- Framework_Laptop_12_13th_Gen_Intel_Core_BIOS_3.08_Step1.exe
- Framework_Laptop_12_13th_Gen_Intel_Core_BIOS_3.09_Step2.exe
Please note that you must update with a charger attached.
Linux/LVFS
Please note that you must update with a charger attached, then run:
fwupdmgr refresh --force
then
fwupdmgr get-updates
then
fwupdmgr update
Please note that you must update with a charger attached.
LVFS may not update if the battery is 100% charged. LVFS uses the battery status to determine if it is safe to apply updates. However if our battery is at 100% and the charger is off, we set the battery charging status to false. In this case you can discharge your battery a few percent, then plug in AC again and run fwupdmgr update.
Linux/Other/UEFI Shell update
| Download Link | SHA256 |
|---|---|
| https://downloads.frame.work/bios/Framework_Laptop_12_13th_Gen_Intel_Core_BIOS_3.09_2Stages_Updater_EFI.zip | F5F89CCE6CCD47E21A8EA6726DF59C96EC091676AD2B3982C512FB09880505AD |
Note that if you use the EFI shell update with Windows, you should suspend Bitlocker if enabled before updating using the EFI updater.
Instructions for EFI shell update:
- Extract contents of zip folder to a FAT32 formatted USB drive. Cleanly unmount the drive before physically removing it, otherwise the BIOS update may not function correctly.
- Attach a charger to your device while updating.
- Boot your system while pressing F12 and boot from the thumb drive.
- Let startup.nsh run automatically.
- This will update to 3.08. The system will reboot several times and apply CSME update.
- Once updated to 3.08, boot your system while pressing F12 and boot from the thumb driver again.
- Let startup.nsh run automatically.
- This will update to 3.09.
Security Fixes
| Module Name | Vulnerability | CVSS Score |
|---|---|---|
| CVE-2025-31648 | Improper handling of values in the microcode flow for some Intel(R) Processor Family may allow an escalation of privilege. Startup code and smm adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (low), integrity (low) and availability (none) impacts. | N/A |
| CVE-2025-27708 | Out-of-bounds read in the firmware for some Intel(R) Converged Security and Management Engine (CSME) Firmware (FW) within Ring 0: Kernel may allow an information disclosure. System software adversary with a privileged user combined with a low complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. | N/A |
| CVE-2025-20080 | Null pointer dereference in the firmware for some Intel(R) AMT and Intel(R) Standard Manageability within Ring 0: Kernel may allow a denial of service. Network adversary with an unauthenticated user combined with a high complexity attack may enable denial of service. This result may potentially occur via network access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. | N/A |
| CVE-2025-32008 | Out-of-bounds write in the firmware for the Intel(R) AMT and Intel(R) Standard Manageability within Ring 3: User Applications may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via network access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (low) impacts. | N/A |
Enhancements
- Added support for Gen 2 HID Keyboards.
- Added support for the single-ROM BIOS Crisis Recovery feature.
- Added fingerprint reader support and power control integration.
- Remapped key event on input deck: F12 now sends KEY_CONFIG instead of KEY_MEDIA.
- Updated thermal tables to improve system stability.
- Updated Microcode to 0x6134.
- Updated CSME to 16.1.40.2765v3.
Fixes
- Fixed an issue where Battery Extender status reported incorrectly following a reboot, hibernation, or shutdown after timer expiration.
- Fixed an issue where PROCHOT# might fail to release upon entering system sleep.
- Security Fixes - CVE-2025-31648, CVE-2025-27708, CVE-2025-20080, CVE-2025-32008.
Component Versions
This BIOS update is a bundle of updates to multiple embedded components in the system.
Not all of them use the same version number.
| Firmware | Version | Update? |
|---|---|---|
| BIOS | 3.09 | Updated |
| Intel SIC | 0C.01.F6.20 | Same |
| Intel CSME | 16.1.40.2765v3 | Updated |
| MCU | 0x6134 | Updated |
| GOP | 21.0.1066 | Same |
| EC | ec_309_9a48264 | Updated |
| PD | 0.0.12 | Same |
Reporting Issues
To report issues we have created a public issue tracker on github. https://github.com/FrameworkComputer/SoftwareFirmwareIssueTracker/issues
We hope that this is a better way to track issues with community involvement moving forward as we have found it difficult to both gather relevant information about issues people are reporting on the forums, and track the issues through their lifecycle in a transparent way.
If you do experience an issue with the update that is related to your system firmware, please post as complete a description as you can, including relevant system information, and external peripherals. Please note that we do not currently have a SLA for responding to issues on github, but we will be reviewing them through the bios release process, and will review them for future updates as well.
If you have an issue regarding hardware, broken devices, returns, etc, this is not the place, please contact Framework Support. https://frame.work/support
Known Issues
None
