Intel and AMD x86 chips have been caught in a cache-flushing mess involving WBINVD and modern power-saving tricks.
According to Phoronix the newly disclosed vulnerability affects the WBINVD instruction, which is supposed to write back and invalidate cache lines before power state changes. When that process goes wonky, stale data can remain visible where it should have vanished.
Chipzilla and AMD are both in the frame, though their fixes are taking different routes. AMD has started pushing microcode updates for affected Ryzen and EPYC parts, while Chipzilla is working with operating system vendors on software workarounds.
The issue appears when processors enter deeper sleep states or shift frequencies. Under specific conditions, the cache flush may not finish properly, leaving old data hanging about across context switches or privilege boundaries.
That breaks the memory consistency guarantees software expects from x86. It is local-code nastiness rather than remote magic, but attackers may not always need elevated privileges to poke at the leftovers.
Linux kernel developers have added patches that alter how scheduler and power management code handles cache maintenance. Rather than leaning on WBINVD in every case, the updated kernel uses safer instruction sequences around idle states and frequency scaling.
Windows updates take a similar line by changing kernel power management behaviour on vulnerable processors. Some Linux distributions have taken the blunter path of disabling deeper C-states until microcode lands, trading power savings for fewer security headaches.
The performance hit depends on the workload. Servers running databases or virtual machines may feel it most, since they constantly bounce between high use and power-saving states. Desktop users will probably notice less unless their machines are always shifting clocks.
Cloud providers get a particularly awkward bill. Limiting power state transitions across fleets of virtual machine hosts increases energy use, while hypervisors such as KVM, Xen and VMware need updates to prevent guests from abusing WBINVD behaviour.
Embedded systems and industrial controllers that use x86 parts need careful testing, as a small increase in latency from mitigation patches can cause problems when the kit has real-time duties and ancient deployment habits.
The bug is different from Spectre and Meltdown, which abused speculative execution, while this one comes from documented cache behaviour failing during power management edge cases, which is a much less glamorous but still grubby problem.
System administrators should check vendor firmware, BIOS updates and operating system patches. Older processors that cannot get microcode fixes will be stuck relying on software workarounds for the foreseeable future.
