Linux kernel: AMD Zen1 divider leaks partial results across SMT threads until the FPDSS bit is set

Impact

On AMD Zen1 parts the hardware divider can retain partial results from a previous operation, and an attacker thread can leak them. The kernel fix sets a chicken bit to stop that. This is a cross-thread leak, so the relevant deployments are first-generation EPYC hosts running more than one tenant per core - SMT siblings sharing a physical core, or a guest sharing a core with another guest. Only Zen1 silicon is affected; later AMD generations are not. The record carries an availability-only CVSS vector, which does not match a data-leak fix - read the upstream commits rather than the score.

Who can reach it

Local code execution on a Zen1 host, running as a thread that shares a physical core with the victim. No special privileges beyond running code are indicated.

What to do

Update to a stable kernel containing the referenced commits and reboot each affected Zen1 node; the chicken bit is applied during CPU init, so a running kernel cannot pick it up. Where a reboot window is far off, disabling SMT on Zen1 hosts removes the cross-thread path at a direct throughput cost. Nodes on Zen2 or newer need nothing.

References

Related entries

• Linux kernel AF_ALG: receive-side scatterlist extraction ignored the receive buffer budgetCVE-2026-31677 · Linux kernel crypto AF_ALG (af_alg_get_rsgl receive buffer accounting)Medium
• Linux kernel BPF: sleepable programs could attach to kprobe_multi and sleep in atomic contextCVE-2026-43010 · Linux kernel BPF (bpf_kprobe_multi_link_attach sleepable program check)Medium
• Linux kernel AF_ALG: missing SGL end-marker clearing lets a local user panic the host via sg_next() NULL dereferenceCVE-2026-43043 · Linux kernel AF_ALG crypto socket interface (af_alg_alloc_tsgl scatterlist chaining)Medium
• Linux kernel algif_aead: minimum receive-buffer check ignores the authentication tag during decryptionCVE-2026-43077 · Linux kernel algif_aead (AF_ALG AEAD receive buffer size check)Medium
• Linux kernel x86 shadow stacks: shstk_pop_sigframe ignores mmap_read_lock_killable() failure on signal returnCVE-2026-43109 · Linux kernel x86 shadow stacks (shstk_pop_sigframe mmap lock error handling)Medium
• Linux kernel EFI/CPER: oversized offset in a firmware error record makes the kernel dump arbitrary memoryCVE-2026-43171 · Linux kernel EFI/CPER firmware error reporting (cper_print_fw_err length underflow)Medium