[Bug 2154728] Re: GDS mitigation not enabled in Ubuntu kernel

Additional official distribution-config evidence for this existing report: I independently reached the same configuration question while comparing current x86_64 distribution kernel configs. I am adding the evidence here instead of opening a duplicate bug. The following official Ubuntu release configurations all contain: # CONFIG_MITIGATION_GDS is not set Observed releases: * Ubuntu 24.04 Noble HWE, 6.17.0-35-generic * Ubuntu 25.10 Questing, 6.17.0-40-generic * Ubuntu 26.04 Resolute, 7.0.0-27-generic The current Resolute configuration therefore shows that the setting persists on the 7.0 kernel line rather than being limited to one older HWE build. In a dependency-aware comparison, all 12 independent current x86_64 peer configuration sources with a known value enable CONFIG_MITIGATION_GDS. Ubuntu/Mint, Debian/Kali, and Alma/Rocky were each collapsed to one vote where they share an effective configuration source, so related distributions were not allowed to inflate the majority. One symbol-history detail may be useful when reviewing the policy. The older CONFIG_MITIGATION_GDS_FORCE=n only avoided force-disabling AVX on systems without suitable microcode. The newer CONFIG_MITIGATION_GDS=n is the top-level mitigation switch itself. Linux v7.0 describes the latter as a default-y option that enables mitigation for Gather Data Sampling: https://github.com/torvalds/linux/blob/v7.0/arch/x86/Kconfig#L2566-L2574 This comment does not add a new hardware reproduction; the original report already contains stronger machine-level evidence, including the result with gather_data_sampling=force. It only adds release persistence, cross-distribution context, and the distinction between the old FORCE option and the current top-level option. Could the Ubuntu kernel team confirm whether CONFIG_MITIGATION_GDS=n on the current Resolute kernel is intentional, and whether the older AVX compatibility rationale is intended to apply to this newer top-level switch? -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2154728 Title: GDS mitigation not enabled in Ubuntu kernel Status in linux package in Ubuntu: Confirmed Bug description: TL;DR: Gather Data Sampling (GDS) vulnerability is not being mitigated in Ubuntu kernel because the config option CONFIG_MITIGATION_GDS is not enabled. This option is necessary so the microcode mitigation be enabled. I have an Intel CPU, and GDS should be mitigated by microcode, but since this config option is not enabled, I don't know if it's because performance or other reason, the mitigation in the microcode doesn't work. I'm comparing with my other kernel, the Liquorix, which has this config option enabled. With it I got: cat /sys/devices/system/cpu/vulnerabilities/gather_data_sampling Mitigation: Microcode Also, with the same kernel I got: sudo rdmsr 291 -a [sudo: authenticate] Password: CPU 0: 0 CPU 1: 0 CPU 2: 0 CPU 3: 0 CPU 4: 0 CPU 5: 0 CPU 6: 0 CPU 7: 0 CPU 8: 0 CPU 9: 0 CPU 10: 0 CPU 11: 0 CPU 12: 0 CPU 13: 0 CPU 14: 0 CPU 15: 0 0 is the correct value accordingly the Intel documentation. Without this option, the result for the command is 10, which means the mitigation is not being applied. How can we change that so the mitigation be put in place? To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2154728/+subscriptions