Processor vulnerabilities (CVEs)

Each entry is a CVE that names a processor, its microcode or the firmware that ships with it as the vulnerable product. CVEs about an operating system’s or a hypervisor’s handling of a processor’s behaviour (such as the SYSRET and FXSAVE flaws of the 2000s) belong to that software and are not listed. Related CVEs are grouped under the name the vulnerability is known by; a CVE whose sources give too little for a page of its own is described on its group’s page.

The affected processors come from Intel’s machine-readable affected-processor list, from the tables Linux 7.3 uses to decide which processors to protect, and from the vendors’ bulletins, and each row cites its source. Intel’s list leaves out processors past the end of their servicing, so a processor missing from a table is not necessarily safe.

Checking a Linux machine

Linux reports what it knows of each vulnerability in a file under /sys/devices/system/cpu/vulnerabilities/: Not affected, Vulnerable, or the mitigation in use. grep . /sys/devices/system/cpu/vulnerabilities/* prints them all. These are the files of Linux 7.3 on x86: