A reported Linux x86 bug could leave Branch History Injection (BHI) protection disabled even when it was still needed against user-to-kernel attacks. Phoronix reported on November 8, 2026, that a proposed correction was included in an x86 pull request.
A kernel without KVM can still need BHI protection against user-to-kernel attacks; the mitigation decision has to account for that attack path.
How the mitigation-selection bug worked
Phoronix reported that bhi_select_mitigation() could select BHI_MITIGATION_OFF whenever CPU_MITIGATE_GUEST_HOST was not set, even if CPU_MITIGATE_USER_KERNEL was set. The two flags concern different attack paths: guest-to-host and user-to-kernel.
In the reported example, a kernel built without KVM could default the guest-to-host flag to off while user-to-kernel protection remained necessary. Phoronix also reported the same selection outcome with the boot parameter mitigations=auto,no_guest_host.
What the x86 pull request proposed
An x86 fixes pull request listed the item “Select the BHI mitigation based on the attack vector properly,” credited to Breno Leitao. The pull request entry describes the proposed change as selecting BHI mitigation according to the attack vector.
Phoronix reported that the pull request was expected to merge before Linux 7.4-rc2, with backports intended for supported kernel branches dating to BHI’s introduction in 2022.
Reported processor scope
For affected Intel CPUs, Phoronix reported that the faulty selection could leave out BHI_DIS_S or the BHB-clearing loop by default. The report also mentioned certain ARM and AMD CPU configurations, without identifying specific models.
