Linux 5.19.1 Released With LTS Kernels Back To 4.19 For The "PBRSB" CPU Issue

A number of new Linux kernel stable releases are out this week with new mitigations around the latest batch of published CPU security vulnerabilities. Linux 5.19.1, 5.18.17, 5.15.60, 5.10.136, 5.4.210, and 4.19.255 are the new releases out today.

Most notable with these new Linux kernel releases are eIBRS-PBRSB after finding Intel eIBRS CPUs to provide insufficient protections. The Linux kernel via its vulnerabilities reporting will now indicate if a system is vulnerable to EIBRS Post-barrier Return Stack Buffer (PBRSB), whether the system is running with protection of RSB on VMEXITs, or if the system is not affected. The kernel change adds an LFENCE to the return stack buffer (RSB) fill sequence and adds RSB VMEXIT protections. The kernel patch treats all Intel eIBRS-using CPUs -- including latest-generation Alder Lake and Xeon Scalable Ice Lake -- as needing PBRSB handling except for Goldmont Plus and Tremont.

From one of the kernel patches:

tl;dr: The Enhanced IBRS mitigation for Spectre v2 does not work as documented for RET instructions after VM exits. Mitigate it with a new one-entry RSB stuffing mechanism and a new LFENCE.

The back-ported x86 security work is in regards to that eIBRS-PBRSB affecting newer Intel CPUs. There are not any kernel mitigation changes at this time around the AMD SQUIP side-channel vulnerability that was also disclosed on Tuesday.

The other changes in today's kernel stable releases are the usual bug fixing. Grab the new stable kernel sources at kernel.org.