CVE-2024-28956

On affected processors, an indirect branch or return whose last byte lies in the lower 32 bytes of a cache line can take its prediction from entries that the predictor’s protections should have kept out: a guest’s branches seen by the host under enhanced IBRS (on some models), other kernel code trained through gadgets such as packet filters, or branches that ran before an IBPB barrier. Intel Atom cores and processors from Alder Lake and Sapphire Rapids on are not affected.

Affected processors

9 of the 28 microarchitectures listed are affected in all or some of their models.

Microarchitecture	Status	Detail	Source
Comet Lake	Affected	06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Indirect Target Selection (IBPB): MCU; Indirect Target Selection (Guest-Host): Software; Indirect Target Selection cBPF: Software 06_A5H stepping 2 (Comet Lake H): Indirect Target Selection (IBPB): MCU; Indirect Target Selection (Guest-Host): Software; Indirect Target Selection cBPF: Software 06_A5H stepping 3 (Comet Lake-S): Indirect Target Selection (IBPB): MCU; Indirect Target Selection (Guest-Host): Software; Indirect Target Selection cBPF: Software 06_A5H stepping 5 (Comet Lake-S): Indirect Target Selection (IBPB): MCU; Indirect Target Selection (Guest-Host): Software; Indirect Target Selection cBPF: Software 06_A6H stepping 0 (Comet Lake U62): Indirect Target Selection (IBPB): MCU; Indirect Target Selection (Guest-Host): Software; Indirect Target Selection cBPF: Software 06_A6H stepping 1 (Comet Lake U62): Indirect Target Selection (IBPB): MCU; Indirect Target Selection (Guest-Host): Software; Indirect Target Selection cBPF: Software	Intel’s list
Cooper Lake	Affected	06_55H stepping B (Cooper Lake): Indirect Target Selection (IBPB): MCU; Indirect Target Selection (Guest-Host): Software; Indirect Target Selection cBPF: Software	Intel’s list
Kaby Lake	Some models	06_8EH stepping 9 (1. Amber Lake-Y - 2. Kaby Lake U - 3. Kaby Lake U23e - 4. Kaby Lake Y): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Indirect Target Selection (IBPB): MCU; Indirect Target Selection (Guest-Host): Software; Indirect Target Selection cBPF: Software 06_9EH stepping 9 (1. Kaby Lake S - 2. Kaby Lake Xeon E3): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected	Intel’s list
Coffee Lake	Some models	06_8EH stepping A (1. Coffee Lake U43e - 2. Whiskey Lake): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected 06_8EH stepping B (Whiskey Lake U): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected 06_8EH stepping C (1. Whiskey Lake V - 2. Comet Lake U42 - 3. Amber Lake Y): Indirect Target Selection (IBPB): MCU; Indirect Target Selection (Guest-Host): Software; Indirect Target Selection cBPF: Software 06_9EH stepping A (Coffee Lake H): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected 06_9EH stepping C (Coffee Lake S): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected 06_9EH stepping D (1. Coffee Lake H - 2. Coffee Lake Xeon E - 3. Coffee Lake S): Indirect Target Selection (IBPB): MCU; Indirect Target Selection (Guest-Host): Software; Indirect Target Selection cBPF: Software	Intel’s list
Ice Lake (client)	Some models	06_7EH stepping 5 (Ice Lake U - Ice Lake Y): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Software	Intel’s list
Tiger Lake	Some models	06_8CH stepping 1 (Tiger Lake U): Indirect Target Selection (IBPB): MCU; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Software 06_8CH stepping 1 (Tiger Lake U): Indirect Target Selection (IBPB): MCU; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Software 06_8CH stepping 2 (1. Tiger Lake U Refresh - 2. Tiger Lake H35): Indirect Target Selection (IBPB): MCU; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Software 06_8DH stepping 1 (Tiger Lake H): Indirect Target Selection (IBPB): MCU; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Software 06_8DH stepping 1 (Tiger Lake H): Indirect Target Selection (IBPB): MCU; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Software	Intel’s list
Rocket Lake	Some models	06_A7H stepping 1 (Rocket Lake): Indirect Target Selection (IBPB): MCU; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Software	Intel’s list
Cascade Lake	Some models	Linux 7.3 lists INTEL_SKYLAKE_X steppings 6 to 7 in cpu_vuln_blacklist with ITS	Linux 7.3
Ice Lake (server)	Some models	06_6AH stepping 6 (Ice Lake Xeon-SP): Indirect Target Selection (IBPB): MCU; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Software 06_6CH stepping All (Ice Lake Xeon D (Idaville)): Indirect Target Selection (IBPB): MCU; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Software	Intel’s list
Haswell	Not affected	06_3FH stepping 2 (Haswell Server EP/EP4S): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected 06_3FH stepping 4 (Haswell Server EX): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected	Intel’s list
Broadwell	Not affected	06_4FH stepping 1 (1. Broadwell Server E/EP/EP4S - 2. Broadwell Server EX): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected 06_56H stepping 3 (Broadwell DE V2 - V3): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected 06_56H stepping 4 (Broadwell DE Y0): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected 06_56H stepping 5 (Hewitt Lake (Broadwell DE)): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected	Intel’s list
Skylake	Not affected	06_5EH stepping 3 (1. Skylake Xeon E3 - 2. Skylake H - 3. Skylake S): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected	Intel’s list
Alder Lake	Not affected	06_97H stepping 2 (Alder Lake S (Golden Cove - Gracemont)): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected 06_97H stepping 5 (Alder Lake S (Golden Cove - Gracemont)): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected 06_97H stepping 5 (Catlow (Golden Cove)): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected 06_9AH stepping 3 (1. Alder Lake H (Golden Cove - Gracemont) - 2. Alder Lake P (Golden Cove - Gracemont)): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected 06_9AH stepping 4 (Alder Lake U (Golden Cove - Gracemont)): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected	Intel’s list
Raptor Lake	Not affected	06_B7H stepping 1 (1. Raptor Lake S - 2. Raptor Lake HX (Raptor Cove/Gracemont)): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected 06_B7H stepping 1 (Catlow (Raptor Cove)): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected 06_BAH stepping 2 - 3 - 8 (1. Raptor Lake P - 2. Raptor Lake H + refresh - 3. Raptor Lake U + refresh (Raptor Cove/Gracemont)): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected 06_BFH stepping 2 - 5 (Raptor Lake S (Raptor Cove/Gracemont)): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected	Intel’s list
Meteor Lake	Not affected	06_AAH stepping 4 (Meteor Lake U/H/PS (Redwood Cove - Crestmont)): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected	Intel’s list
Arrow Lake	Not affected	06_B5H stepping 0 (Arrow Lake U (Redwood Cove - Crestmont)): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected 06_C5H stepping 2 (Arrow Lake H (Lion Cove - Skymont)): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected 06_C6H stepping 2 (Arrow Lake H/HX/S/S Plus (Lion Cove - Skymont)): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected	Intel’s list
Lunar Lake	Not affected	06_BDH stepping 1 (Lunar Lake (Lion Cove - Skymont)): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected	Intel’s list
Panther Lake	Not affected	06_CCH stepping 2 - 3 (Panther Lake (Cougar Cove - Darkmont)): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected	Intel’s list
Skylake-SP	Not affected	06_55H stepping 3 (Skylake Server): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected 06_55H stepping 4 (1. Skylake Server - 2. Skylake D/Bakerville): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected	Intel’s list
Emerald Rapids	Not affected	06_CFH stepping 2 (Emerald Rapids (Raptor Cove)): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected	Intel’s list
Sapphire Rapids	Not affected	06_8FH stepping 5 - 6 - 7 - 8 (1. Sapphire Rapids - 2. Sapphire Rapids Edge Enhanced (Golden Cove)): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected 06_8FH stepping 5 - 6 - 8 (Sapphire Rapids (Golden Cove) - Sapphire Rapids HBM): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected	Intel’s list
Granite Rapids	Not affected	06_ADH stepping 1 (Granite Rapids (Redwood Cove)): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected 06_ADH stepping 1 (Granite Rapids (Redwood Cove)): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected 06_ADH stepping 1 (Granite Rapids R1S (Redwood Cove)): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected 06_AEH stepping 1 (Granite Rapids D (Redwood Cove)/Kaseyville): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected	Intel’s list
Sierra Forest	Not affected	06_AFH stepping 3 (Sierra Forest (Crestmont)): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected	Intel’s list
Clearwater Forest	Not affected	06_DDH stepping 1 (Clearwater Forest (Darkmont)): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected	Intel’s list
Goldmont	Not affected	06_5CH stepping A (Apollo Lake): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected 06_5FH stepping All (Denverton (Goldmont)): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected	Intel’s list
Goldmont Plus	Not affected	06_7AH stepping 8 (Gemini Lake): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected	Intel’s list
Tremont	Not affected	06_86H stepping 5 (Snow Ridge BTS (Tremont)): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected 06_86H stepping 7 (Parker Ridge / Snow Ridge NS/NX/BTS): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected 06_96H stepping All (Elkhart Lake (Tremont)): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected 06_9CH stepping All (Jasper Lake (Tremont)): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected	Intel’s list
Gracemont	Not affected	06_9AH stepping 4 (Arizona Beach (Gracemont)): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected 06_BEH stepping 0 (Alder Lake N (Gracemont)/Twin Lake): Indirect Target Selection (IBPB): Not Affected; Indirect Target Selection (Guest-Host): Not Affected; Indirect Target Selection cBPF: Not Affected	Intel’s list

Mitigations

• Kernel: Linux moves indirect branches out of the lower half of their cache line: it patches retpoline sites to point to thunks whose branch sits in the upper half. Source.
• Microcode: Intel's 2025 microcode fixes the IBPB part, so that IBPB discards these predictions too. Source.

How to check a machine

On Linux, /sys/devices/system/cpu/vulnerabilities/indirect_target_selection holds one of these lines:

• Not affected
• Vulnerable
• Mitigation: Vulnerable, KVM: Not affected
• Mitigation: Aligned branch/return thunks
• Mitigation: Retpolines, Stuffing RSB

Source.