Linux x86/srso - SRSO mitigation missing for Hygon processors: MULTI-TENANT ISOLATION: The kernel's Speculative Return

Impact

MULTI-TENANT ISOLATION: The kernel's Speculative Return Stack Overflow (Inception) mitigation was not applied to Hygon processors, which are AMD Zen derivatives and carry the same defect. Any Hygon node in the fleet therefore ran with the SRSO mitigation silently inactive - a cross-privilege speculative disclosure channel that your vulnerability dashboard reported as mitigated.

Who can reach it

Local, cross-privilege speculative execution on Hygon silicon.

What to do

Fixed in the Linux kernel by extending the SRSO mitigation to Hygon. Distro kernel update plus reboot; no firmware step. Verify afterwards by reading /sys/devices/system/cpu/vulnerabilities/spec_rstack_overflow on Hygon nodes rather than trusting the CPU vendor string to have been handled correctly - this bug existed precisely because it was not.

References