A Linux kernel patch series proposed removing software-driven cache flushes around Intel TDX memory transitions between KeyIDs, because finalized TDX hardware can handle the relevant work without software assistance, according to a Phoronix report published October 18, 2026. Phoronix said the series was dated October 15 and was pending when it published its report.
What the Linux patch proposes to change
The proposal targets software cache-flushing code around transitions between KeyIDs. Phoronix attributed the rationale to Intel software engineer Rick Edgecombe, whose explanation said the hardware could handle the relevant issue without software help and that the TDX architecture and Linux code were being adjusted accordingly.
How KeyIDs fit into TDX
Intel Trust Domain Extensions (Intel TDX) supports confidential virtual machines called Trust Domains. Intel’s MKTME security advisory, updated March 10, 2026, explains that Multi-Key Total Memory Encryption (MKTME) encrypts each Trust Domain’s memory with a unique AES key. A KeyID identifies which key a memory request uses.
Intel’s separate cache side-channel guidance
The patch report does not describe the same behavior as Intel’s advisory on KeyID aliasing. Intel says that, in certain configurations, an untrusted virtual machine monitor (VMM) with the required privileges can observe a Trust Domain’s memory-access patterns at cache-line granularity. Intel says the attacks described in the advisory reveal those patterns, not the data stored at the accessed addresses.
Intel recommends avoiding memory accesses that depend on secret values. It also says software should not rely on whether KeyID-related cache-coherence flows are present, since future processors may change them.
What the report says about performance
Phoronix described simpler kernel code as the proposed change’s result. Its report gave no expected performance impact or measured performance result, so the proposal does not establish a performance gain.
