Stable Updates Back To Linux 4.9 Released For Intel MMIO Stale Data Vulnerabilities

Disclosed on Tuesday was the set of Intel "MMIO Stale Data" vulnerabilities. Committed immediately at embargo lift was the mitigation patches for Linux 5.19 Git while the patches have now worked their way back to the maintained stable kernel series. Out this morning is a slew of stable kernel releases back to Linux 4.9 for patching the Intel MMIO Stale Data vulnerabilities that affect many generations of Intel CPUs from Rocket Lake and older.

Out this morning is Linux 4.9.319, Linux 4.14.284, Linux 4.19.248, Linux 5.4.199, Linux 5.10.123, Linux 5.15.48, and Linux 5.18.5.

Besides needing a patched kernel, the latest Intel CPU microcode is required. Intel didn't publish any new Linux CPU microcode files this week but based on my testing of the MMIO Stale Data patches, it looks like the necessary changes for the mitigation are present within Intel's May 2022 CPU microcode updates. Versions prior to that May release in my testing reported the CPU microcode as vulnerable/unsupported, but the May microcode did successfully work for the mitigation.

With the patched kernel the mitigation status can be checked via /sys/devices/system/cpu/vulnerabilities/mmio_stale_data. The mmio_stale_data= kernel parameter can be used for forcing the mitigation off if desired or also disabling SMT/HT if relevant in order to "fully" mitigate against this set of security issues.