Retbleed

Retpolines replace indirect branches with returns on the assumption that returns are predicted only from the return stack buffer. On some Intel processors, a return falls back to the branch target buffer when the return stack buffer runs empty; on some AMD processors, the predictor can take a return for another kind of branch and predict it from the branch target buffer. Either way an attacker can steer kernel returns as in variant 2.

CVEs

CVE	Name	Vendors	Published
CVE-2022-23825	Branch Type Confusion (BTC) (described below)	AMD	2022-07-14
CVE-2022-28693	Restricted RSB Alternate behavior (RRSBA) (described below)	Intel	2025-02-14
CVE-2022-29900	Retbleed (AMD) (Retbleed, Branch Type Confusion)	AMD, Hygon	2022-07-12
CVE-2022-29901	Return Stack Buffer Underflow (Retbleed, RSBA)	Intel	2022-07-12

How to check a machine

On Linux, /sys/devices/system/cpu/vulnerabilities/retbleed reports it; the kernel’s documentation lists the lines it can hold.

CVEs without a page of their own

The sources give these CVEs too few facts of their own (affected processors, a mitigation, a check) for a page; this is what they say.

CVE-2022-23825: Branch Type Confusion

Aliases in AMD's branch predictor make it predict the wrong type of branch; it shares its bulletin, affected products and mitigation with AMD's Retbleed. AMD-SB-1037. Source. CVE record (2022-07-14).

CVE-2022-28693: Restricted RSB Alternate behavior

Processors with enhanced IBRS whose returns can still fall back to other predictors, though only to targets of the same mode. INTEL-SA-00707. Source. CVE record (2025-02-14).