Linux kernel arm64: TSV110 CPUs were not getting the Spectre-BHB software mitigation

Impact

The TSV110 core is vulnerable to Spectre-BHB branch-history side-channel attacks, but its MIDR was absent from the kernel's list of parts needing the software mitigation, so affected machines ran unmitigated. On a shared Arm host this is a cross-boundary information leak primitive: a local tenant process can use branch prediction history to infer data it should not see, including across a container boundary on the same core. The exposure is limited to hosts built on TSV110 cores; everything else in the fleet was already covered. Note that the fix only adds the mitigation - it does not change the underlying hardware behaviour.

Who can reach it

Local code execution on a TSV110-based host. No special privilege is needed beyond running a process, which on a GPU cloud means any tenant workload sharing the machine. Not reachable over the network.

What to do

Update to a stable kernel that carries the TSV110 MIDR in the Spectre-BHB list and reboot the node - the mitigation is selected at boot from the CPU id, so a running kernel cannot be corrected in place. Expect the usual Spectre-BHB mitigation performance cost once it takes effect. Only TSV110 hosts need the maintenance window.

References

Related entries

• Linux kernel KVM: spurious userspace exit when checking nested events can kill the guestCVE-2026-43265 · Linux kernel KVM x86 nested virtualization (vcpu_block() nested-event check returning -EBUSY)Medium
• Linux kernel EFI/CPER: an oversized ARM processor error record is trusted and read past the firmware bufferCVE-2026-43266 · Linux kernel EFI/CPER ARM processor error record parser (section_length / ERR_INFO_NUM not bounded)Medium
• Linux kernel CephFS client: punch-hole writes without snapshot context silently corrupt existing snapshotsCVE-2026-43273 · Linux kernel CephFS client (ceph_zero_partial_object missing snapshot context on OSD writes)Medium
• Linux kernel KVM nSVM: userspace can trigger a kernel WARN by changing CPUID after loading CR3CVE-2026-43315 · Linux kernel KVM nSVM (user-triggerable WARN in svm_set_nested_state)Medium
• Linux kernel scheduler: two yielding tasks can overflow vruntime and destabilize the hostCVE-2026-43323 · Linux kernel sched/fair (zero_vruntime not updated at slice end, EEVDF vruntime overflow)Medium
• Linux kernel BPF: verifier lets a program dereference a nullable map-iterator pointer, crashing the kernelCVE-2026-43333 · Linux kernel BPF verifier (check_mem_access allows direct deref of nullable PTR_TO_BUF)Medium