Linux 5.16 Loosens The Spectre Defaults Around SSBD / STIBP

Written by Michael Larabel in Linux Security on 1 November 2021 at 02:13 PM EDT. 2 Comments
Linux 5.16 is adjusting its default Spectre mitigation behavior around Spectre V2 for user-space tasks as well as Speculative Store Bypass Disable (SSBD) for Spectre V4 mitigation.

Rather than the existing default behavior of applying the mitigations by default to all SECCOMP threads and those opting into those mitigations per-thread via the Linux kernel's prctl() interface, with Linux 5.16 the default is being pulled back to just the prctl() opt-in behavior. This change has been talked about over the past year and previously covered within Linux Preparing To Slightly Loosen Its Spectre Defaults.

Removing the mitigations by default for SECCOMP processes is done to avoid a false sense of security particularly in cases of SMT/HT active. Through other speculative execution vulnerabilities and their mitigations and other system software changes over the past three years have led to the current default being re-evaluated with the decision to not blanket application of SSBD/STIBP by default to all SECCOMP processes.

This patch message describes the reasoning for this default change in more detail.
Ultimately setting SSBD and STIBP by default for all seccomp jails is a bad sweet spot and bad default with more cons than pros that end up reducing security in the public cloud (by giving an huge incentive to not expose SPEC_CTRL which would be needed to get full security with IBPB after setting nosmt in the guest) and by excessively hurting performance to more secure apps using seccomp that end up having to opt out with SECCOMP_FILTER_FLAG_SPEC_ALLOW.

Those wanting to keep the former default can still do so via the Spectre kernel options and sysfs.

This default change was sent in via this pull request for Linux 5.16.
Related News
About The Author
Michael Larabel

Michael Larabel is the principal author of and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and automated benchmarking software. He can be followed via Twitter, LinkedIn, or contacted via

Popular News This Week