CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection

CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

x86/bugs: Make Safe-RET robust against interrupt injection

An attacker injecting interrupts while the Safe-RET mitigation executes
on machines affected by SRSO can neutralize the safe return sequence,
potentially leading to data leakage through speculative execution.

Fixup register state as if the Safe-RET sequence executed successfully
by "emulating" it, in a manner of speaking, and avoid executing a RET
instruction after returning from the interrupt.

The Linux kernel CVE team has assigned CVE-2026-68480 to this issue.


Affected and fixed versions
===========================

	Fixed in 5.10.263 with commit 9de1a49e8f1fbf7c372902573a27a97d4ab4d0af
	Fixed in 5.15.214 with commit 9c0b8105e919be5208c81d5516a194a28c58fe1e
	Fixed in 6.1.181 with commit 95b08cdd603fe79d2e9d5212fbb13d577c835f4f
	Fixed in 6.6.149 with commit 608c8f5dccaaf8b8d2b28c0fbdd439d144be62b0
	Fixed in 6.18.43 with commit bfe7f9993467ba431b2731437949ac1e2634e771
	Fixed in 7.1.7 with commit 61649a2d61cb0dbc673f0f232f0f0c298bf50442

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68480
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	arch/x86/entry/entry_64.S
	arch/x86/include/asm/nospec-branch.h
	arch/x86/kernel/cpu/bugs.c
	arch/x86/lib/retpoline.S


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/9de1a49e8f1fbf7c372902573a27a97d4ab4d0af
	https://git.kernel.org/stable/c/9c0b8105e919be5208c81d5516a194a28c58fe1e
	https://git.kernel.org/stable/c/95b08cdd603fe79d2e9d5212fbb13d577c835f4f
	https://git.kernel.org/stable/c/608c8f5dccaaf8b8d2b28c0fbdd439d144be62b0
	https://git.kernel.org/stable/c/bfe7f9993467ba431b2731437949ac1e2634e771
	https://git.kernel.org/stable/c/61649a2d61cb0dbc673f0f232f0f0c298bf50442
	https://git.kernel.org/stable/c/7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9

Re: CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection

[Thomas Lamprecht]

On 06/08/2026 19:41, Greg Kroah-Hartman wrote:
> From: Greg Kroah-Hartman <gregkh@kernel.org>
> 
> Description
> ===========
> 
> In the Linux kernel, the following vulnerability has been resolved:
> 
> x86/bugs: Make Safe-RET robust against interrupt injection
> 
> An attacker injecting interrupts while the Safe-RET mitigation executes
> on machines affected by SRSO can neutralize the safe return sequence,
> potentially leading to data leakage through speculative execution.
> 
> Fixup register state as if the Safe-RET sequence executed successfully
> by "emulating" it, in a manner of speaking, and avoid executing a RET
> instruction after returning from the interrupt.
> 
> The Linux kernel CVE team has assigned CVE-2026-68480 to this issue.
> 
> 
> Affected and fixed versions
> ===========================
> 
> 	Fixed in 5.10.263 with commit 9de1a49e8f1fbf7c372902573a27a97d4ab4d0af
> 	Fixed in 5.15.214 with commit 9c0b8105e919be5208c81d5516a194a28c58fe1e
> 	Fixed in 6.1.181 with commit 95b08cdd603fe79d2e9d5212fbb13d577c835f4f
> 	Fixed in 6.6.149 with commit 608c8f5dccaaf8b8d2b28c0fbdd439d144be62b0

I hope I did not overlooked something, but at least the 6.6 backport seems
broken to me as it #ifdef guards the fixes on CONFIG_MITIGATION_SRSO, but that
config name is only used in v6.9+ since a033eec9a06ce ("x86/bugs: Rename
CONFIG_CPU_SRSO             => CONFIG_MITIGATION_SRSO") [0] FWICT, i.e. before
that version it was named CONFIG_CPU_SRSO. So shouldn't be that be used here
for all the older pre-v6.9 backports above?

[0]: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a033eec9a06ce25388e71fa1e888792a718b9c17

> 	Fixed in 6.18.43 with commit bfe7f9993467ba431b2731437949ac1e2634e771
> 	Fixed in 7.1.7 with commit 61649a2d61cb0dbc673f0f232f0f0c298bf50442
> 

> Mitigation
> ==========
> 
> The Linux kernel CVE team recommends that you update to the latest
> stable kernel version for this, and many other bugfixes.  Individual
> changes are never tested alone, but rather are part of a larger kernel
> release.  Cherry-picking individual commits is not recommended or
> supported by the Linux kernel community at all.  If however, updating to
> the latest release is impossible, the individual changes to resolve this
> issue can be found at these commits:
> 	https://git.kernel.org/stable/c/9de1a49e8f1fbf7c372902573a27a97d4ab4d0af
> 	https://git.kernel.org/stable/c/9c0b8105e919be5208c81d5516a194a28c58fe1e
> 	https://git.kernel.org/stable/c/95b08cdd603fe79d2e9d5212fbb13d577c835f4f
> 	https://git.kernel.org/stable/c/608c8f5dccaaf8b8d2b28c0fbdd439d144be62b0
> 	https://git.kernel.org/stable/c/bfe7f9993467ba431b2731437949ac1e2634e771
> 	https://git.kernel.org/stable/c/61649a2d61cb0dbc673f0f232f0f0c298bf50442
> 	https://git.kernel.org/stable/c/7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9

Re: CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection

[Borislav Petkov]

On Thu, Aug 06, 2026 at 11:42:59PM +0200, Thomas Lamprecht wrote:
> > 	Fixed in 5.10.263 with commit 9de1a49e8f1fbf7c372902573a27a97d4ab4d0af
> > 	Fixed in 5.15.214 with commit 9c0b8105e919be5208c81d5516a194a28c58fe1e
> > 	Fixed in 6.1.181 with commit 95b08cdd603fe79d2e9d5212fbb13d577c835f4f
> > 	Fixed in 6.6.149 with commit 608c8f5dccaaf8b8d2b28c0fbdd439d144be62b0
> 
> I hope I did not overlooked something, but at least the 6.6 backport seems
> broken to me as it #ifdef guards the fixes on CONFIG_MITIGATION_SRSO, but that
> config name is only used in v6.9+ since a033eec9a06ce ("x86/bugs: Rename
> CONFIG_CPU_SRSO             => CONFIG_MITIGATION_SRSO") [0] FWICT, i.e. before
> that version it was named CONFIG_CPU_SRSO. So shouldn't be that be used here
> for all the older pre-v6.9 backports above?

Thanks for letting me know - I'm fixing.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette

Re: CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection

[Borislav Petkov]

On Thu, Aug 06, 2026 at 03:42:00PM -0700, Borislav Petkov wrote:
> On Thu, Aug 06, 2026 at 11:42:59PM +0200, Thomas Lamprecht wrote:
> > > 	Fixed in 5.10.263 with commit 9de1a49e8f1fbf7c372902573a27a97d4ab4d0af
> > > 	Fixed in 5.15.214 with commit 9c0b8105e919be5208c81d5516a194a28c58fe1e
> > > 	Fixed in 6.1.181 with commit 95b08cdd603fe79d2e9d5212fbb13d577c835f4f
> > > 	Fixed in 6.6.149 with commit 608c8f5dccaaf8b8d2b28c0fbdd439d144be62b0
> > 
> > I hope I did not overlooked something, but at least the 6.6 backport seems
> > broken to me as it #ifdef guards the fixes on CONFIG_MITIGATION_SRSO, but that
> > config name is only used in v6.9+ since a033eec9a06ce ("x86/bugs: Rename
> > CONFIG_CPU_SRSO             => CONFIG_MITIGATION_SRSO") [0] FWICT, i.e. before
> > that version it was named CONFIG_CPU_SRSO. So shouldn't be that be used here
> > for all the older pre-v6.9 backports above?
> 
> Thanks for letting me know - I'm fixing.

Hopefully fixed kernels are out now. Sorry for the trouble.

Thx.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette

Re: CVE-2026-68480: x86/bugs: Make Safe-RET robust against interrupt injection

[Greg Kroah-Hartman]

On Thu, Aug 06, 2026 at 11:31:19PM -0700, Borislav Petkov wrote:
> On Thu, Aug 06, 2026 at 03:42:00PM -0700, Borislav Petkov wrote:
> > On Thu, Aug 06, 2026 at 11:42:59PM +0200, Thomas Lamprecht wrote:
> > > > 	Fixed in 5.10.263 with commit 9de1a49e8f1fbf7c372902573a27a97d4ab4d0af
> > > > 	Fixed in 5.15.214 with commit 9c0b8105e919be5208c81d5516a194a28c58fe1e
> > > > 	Fixed in 6.1.181 with commit 95b08cdd603fe79d2e9d5212fbb13d577c835f4f
> > > > 	Fixed in 6.6.149 with commit 608c8f5dccaaf8b8d2b28c0fbdd439d144be62b0
> > > 
> > > I hope I did not overlooked something, but at least the 6.6 backport seems
> > > broken to me as it #ifdef guards the fixes on CONFIG_MITIGATION_SRSO, but that
> > > config name is only used in v6.9+ since a033eec9a06ce ("x86/bugs: Rename
> > > CONFIG_CPU_SRSO             => CONFIG_MITIGATION_SRSO") [0] FWICT, i.e. before
> > > that version it was named CONFIG_CPU_SRSO. So shouldn't be that be used here
> > > for all the older pre-v6.9 backports above?
> > 
> > Thanks for letting me know - I'm fixing.
> 
> Hopefully fixed kernels are out now. Sorry for the trouble.

Thanks for the quick response, and for Thomas the review.  If there are
any issues with the newly released kernels now, please let us know.

thanks,

greg k-h