Five Linux LTS kernel stable releases landed today, all shipping a hardened Safe-RET mitigation to plug a subtle interrupt-injection flaw in SRSO-affected AMD processors. The patch, led by AMD's Borislav Petkov, adds an LFENCE and a register-state adjustment routine to prevent speculative execution from leaking kernel data when interrupts occur mid-sequence. Initial attempts to land the fix in the 5.10 and 5.15 trees were immediately reverted, highlighting just how tricky the edge case proved for stable maintainers. The vulnerability requires local code execution and carries minimal performance overhead, so systems with CONFIG_MITIGATION_SRSO enabled should update as soon as their distros push the new kernels.
Linux Kernel Stable Releases Drop for August 7, Hardening Safe-RET Against Interrupt Injection
Five Linux kernel stable releases landed this today, August 7, and if you're running AMD silicon, the headline fix in every single one is the one you'll actually care about. Linux 5.10.264, 5.15.215, 6.1.182, 6.6.150, and 6.12.102 all ship with a hardened Safe-RET mitigation that finally plugs a subtle interrupt-injection edge case for SRSO-affected processors. Greg Kroah-Hartman signed off on all five, and the patch set is already flowing through the stable trees.
SRSO has been on distro radars for roughly two years now. It's an AMD-specific speculative execution flaw that targets the Return Stack Buffer inside the branch predictor. If your return addresses get mispredicted, an attacker can leak kernel data through speculation. Safe-RET has been the standard countermeasure, borrowing heavily from retpoline-style code to keep indirect returns predictable. It worked well enough for everyday workloads. It just had a gap when the CPU took an interrupt mid-sequence.
The Interrupt Injection Edge Case
The new patch, authored primarily by AMD's Borislav Petkov alongside David Kaplan and Wenkuan Wang, slaps an LFENCE around the interrupted-safe-RET path and introduces a handle_interrupted_saferet() routine that adjusts register state so the processor doesn't speculatively run a half-trained safe return sequence. The fix only activates when CONFIG_MITIGATION_SRSO is enabled, which every major distro ships with by default.
Here's where the patch history gets genuinely messy. The very first attempt to land this fix in the 5.10 and 5.15 trees got reverted the same day Kroah-Hartman signed it off. His commit message was brutally concise: "It was incorrect, a more correct fix will be applied next." The 6.1 tree pulled a similar stunt, reverting a prior backport to make room for the upstream version in the same release cycle. That back-and-forth tells you exactly how sneaky the interrupt-injection edge case was. Kernel stable maintainers usually treat reverts like a bad smell, but microarchitecture bugs don't care about your release schedule. The team had to trace a path where userspace poisoned the Branch Target Buffer, triggered an exception, and forced the kernel to mis-speculate a return from kernel space. Only then did the flaw become obvious.
The attack complexity isn't trivial either. You still need local code execution plus the ability to trigger specific exceptions right while Safe-RET is running. The performance hit? Negligible. The LFENCE only triggers on the rare interrupted-safe-RET path, so you're not watching your CPU throttle itself on everyday workloads.
Performance and Distribution Impact
If you're on an EPYC or Ryzen box, grab the update this week. You can verify your config with grep CONFIG_MITIGATION_SRSO /boot/config-$(uname -r). Systems affected cover everything from recent Ryzen desktop chips to the full EPYC lineage that first shipped with Zen 3. Distro update pipelines will pick these up within days, though rolling release distributions typically push the patches out faster than point-release ones.
Keep in mind that the patch targets x86_64 only. ARM and RISC-V architectures don't ship the same Return Stack Buffer behavior, so they're unaffected. The revert-and-reapply pattern across multiple branches is just a reminder that CPU microarchitecture bugs often hide in the edges of mitigation code. Iterative refinement wins here.
Linux kernel 5.10.264 released
Linux kernel version 5.10.264 is now available:
Full source: https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.10.264.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v5.x/patch-5.10.264.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.10.264.tar.sign
You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v5.10.264/v5.10.263
Linux kernel 5.15.215 released
Linux kernel version 5.15.215 is now available:
Full source: https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.15.215.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v5.x/patch-5.15.215.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.15.215.tar.sign
You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v5.15.215/v5.15.214
Linux kernel 6.1.182 released
Linux kernel version 6.1.182 is now available:
Full source: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.1.182.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v6.x/patch-6.1.182.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.1.182.tar.sign
You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v6.1.182/v6.1.181
Linux kernel 6.6.150 released
Linux kernel version 6.6.150 is now available:
Full source: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.6.150.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v6.x/patch-6.6.150.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.6.150.tar.sign
You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v6.6.150/v6.6.149
Linux kernel 6.12.102 released
Linux kernel version 6.12.102 is now available:
Full source: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.12.102.tar.xz
Patch: https://cdn.kernel.org/pub/linux/kernel/v6.x/patch-6.12.102.xz
PGP Signature: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.12.102.tar.sign
You can view the summary of the changes at the following URL:
https://git.kernel.org/stable/ds/v6.12.102/v6.12.101
