# Linux kernel fixes BHI vulnerability mitigation failing on non-KVM builds

> **Key takeaway:** The Branch History Injection mitigation was silently disabled when KVM was not compiled in, leaving affected Intel, AMD, and ARM CPUs exposed to user-to-kernel attacks.

**Published:** 2026-11-08T11:03:38+00:00 
**Source:** Phoronix Benchmarks & Drivers 
**Category:** kernel-os 
**Canonical URL:** https://fosswire.org/news/linux-kernel-fixes-bhi-vulnerability-mitigation-failing-on-n.html 

## Summary
A logic flaw in the Linux kernel's Branch History Injection (BHI) mitigation selection caused the protection to be incorrectly disabled on kernels built without KVM virtualization support, even though BHI remains exploitable through user-to-kernel attack vectors. Debian developer Breno Leitao identified that bhi_select_mitigation() only activated when CPU_MITIGATE_GUEST_HOST was set, defaulting to BHI_MITIGATION_OFF without KVM since that flag is off by default, despite CPU_MITIGATE_USER_KERNEL still requiring the defense on vulnerable hardware.

The fix ensures BHI mitigations apply correctly regardless of KVM configuration, restoring BHI_DIS_S or the BHB clearing loop on affected Intel processors. The patch is queued for Linux 7.4-rc2 and marked for back-porting to all supported kernels since BHI mitigations were introduced in 2022. This week's x86 fixes also include AMD RMPOPT handling improvements for SEV-SNP hosts.

## BHI mitigation logic and affected configurations
- **Mitigation selection bug:** bhi_select_mitigation() gated BHI protection solely on CPU_MITIGATE_GUEST_HOST, ignoring CPU_MITIGATE_USER_KERNEL and causing BHI_MITIGATION_OFF selection when KVM was disabled at compile time.
- **Attack vector mismatch:** The kernel documentation (attack_vector_controls.rst) explicitly lists BHI under both user->kernel and guest->host vectors, but the implementation only honored the guest->host path.
- **Affected CPUs:** Multiple generations of Intel CPUs lost BHI_DIS_S or BHB clearing loop protection; certain ARM and AMD processors were also impacted by the faulty selection logic.
- **Equivalent runtime trigger:** Booting with mitigations=auto,no_guest_host produced the same vulnerable state even on KVM-enabled kernels, broadening the exposure surface.
- **Back-port scope:** The fix applies to all maintained kernel branches since BHI mitigations landed in 2022, reflecting the long-standing nature of the defect.

## Why it matters
Distribution kernels that disable KVM for size or security reasons—common in container-optimized and embedded builds—have been shipping without BHI protection on vulnerable hardware for up to four years. System administrators running custom kernel configurations or minimal cloud images should verify their mitigation status and prioritize updates once back-ports land, as BHI enables cross-privilege-boundary speculative execution attacks that bypass traditional isolation boundaries.