Linux LTS 5.10.263 and 5.15.214 ship patch for AMD Safe-RET bypass
A flaw in the Linux mitigation for speculative execution attacks gets fixed in this week’s stable kernel releases.
Greg Kroah-Hartman pushed out Linux 5.10.263 and 5.15.214 on August 6, 2026. Both stable trees carry a single upstream commit that hardens the kernel's existing protection against Speculative Return Stack Overflow, or SRSO. The patch closes a timing window that lets attackers trip the CPU's branch predictor safeguards with carefully timed interrupts.
Speculative execution attacks have been a recurring headache since Spectre and Meltdown cracked open the hardware supply chain in 2018. AMD's SRSO problem is technically a different beast, but the pattern of patching silicon with software is familiar territory for anyone maintaining production boxes. The fix is already live. You just need to update.
How the Bypass Works
The Linux kernel protects Zen 1 through Zen 4 processors with a "Safe RET" sequence that swaps out return addresses before speculative execution continues. It works in isolation. The problem shows up when an attacker with local code execution can inject an interrupt during the critical execution phase. The protective swap gets interrupted mid-flight. Registers retain their old state. The processor speculatively follows a poisoned return address and leaks data through side channels.
AMD has confirmed the bypass works on Zen 1 and Zen 2. Zen 3 and Zen 4 likely fall into the same pattern, though the company hasn't demonstrated a working exploit against them yet. The attack requires precise timing, which raises the complexity bar, but that only matters if you're not already running untrusted user space on shared hardware.
The Patch
The upstream fix lands at commit 7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9. It was co-developed by AMD's Borislav Petkov and David Kaplan. The logic is straightforward: force the register state to behave as if the Safe RET sequence finished successfully, regardless of when the interrupt fires. It also blocks any RET instruction from running after the interrupt returns, closing the timing window entirely.
Not cheap. At least the patch itself doesn't ask for a recompilation of the entire kernel, and it applies cleanly to both maintenance lines.
AMD addressed the finding in Security Bulletin AMD-SB-7061, crediting MIT CSAIL researcher Daniël Trujillo for the report. The bulletin characterizes the issue as specific to the Linux implementation rather than a flaw in the silicon, which is a meaningful distinction. Hardware bugs are notoriously hard to fix at scale. Software hardening tends to move faster.
Head here to track the official AMD response, but the practical takeaway is straightforward. Update to 5.10.263 or 5.15.214. Make sure your AMD microcode is current, since the underlying CPU firmware still has to cooperate with the kernel's mitigation. Keep in mind that this requires local code access to exploit, so the immediate threat is mostly to cloud instances, shared hosting, and any system running untrusted user space. A formal CVE identifier should arrive once coordination wraps up, though the patch itself is already in production.
Linux kernel 5.10.263 released
Linux kernel version 5.10.263 is now available:
Full source: https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.10.263.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v5.x/patch-5.10.263.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.10.263.tar.sign
You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v5.10.263/v5.10.262
Linux kernel 5.15.214 released
Linux kernel version 5.15.214 is now available:
Full source: https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.15.214.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v5.x/patch-5.15.214.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.15.214.tar.sign
You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v5.15.214/v5.15.213
