CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

x86/bugs: Make Safe-RET robust against interrupt injection

An attacker injecting interrupts while the Safe-RET mitigation executes
on machines affected by SRSO can neutralize the safe return sequence,
potentially leading to data leakage through speculative execution.

Fixup register state as if the Safe-RET sequence executed successfully
by "emulating" it, in a manner of speaking, and avoid executing a RET
instruction after returning from the interrupt.

The Linux kernel CVE team has assigned CVE-2026-68480 to this issue.


Affected and fixed versions
===========================

	Fixed in 5.10.263 with commit 9de1a49e8f1fbf7c372902573a27a97d4ab4d0af
	Fixed in 5.15.214 with commit 9c0b8105e919be5208c81d5516a194a28c58fe1e
	Fixed in 6.1.181 with commit 95b08cdd603fe79d2e9d5212fbb13d577c835f4f
	Fixed in 6.6.149 with commit 608c8f5dccaaf8b8d2b28c0fbdd439d144be62b0
	Fixed in 6.18.43 with commit bfe7f9993467ba431b2731437949ac1e2634e771
	Fixed in 7.1.7 with commit 61649a2d61cb0dbc673f0f232f0f0c298bf50442

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68480
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	arch/x86/entry/entry_64.S
	arch/x86/include/asm/nospec-branch.h
	arch/x86/kernel/cpu/bugs.c
	arch/x86/lib/retpoline.S


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/9de1a49e8f1fbf7c372902573a27a97d4ab4d0af
	https://git.kernel.org/stable/c/9c0b8105e919be5208c81d5516a194a28c58fe1e
	https://git.kernel.org/stable/c/95b08cdd603fe79d2e9d5212fbb13d577c835f4f
	https://git.kernel.org/stable/c/608c8f5dccaaf8b8d2b28c0fbdd439d144be62b0
	https://git.kernel.org/stable/c/bfe7f9993467ba431b2731437949ac1e2634e771
	https://git.kernel.org/stable/c/61649a2d61cb0dbc673f0f232f0f0c298bf50442
	https://git.kernel.org/stable/c/7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9