Microsoft's Code Integration into Linux Kernel 6.13 Sparks Security Crisis; Intel and AMD Swiftly Respond
2025-01-14

The recent release of the Linux kernel 6.13 encountered a major security scare stemming from a Microsoft code submission that was merged into the kernel without undergoing a thorough review process. The code, designed to enhance performance for the x86_64/AMD64 architecture, included the Read-Only eXecution (ROX) permission caching executable memory (EXECMEM) feature. Unfortunately, this rushed integration compromised Control Flow Integrity (CFI), jeopardizing the system's security. Promptly, Intel developer Peter Zijlstra submitted an emergency patch to address the issue, while AMD developer Borislav Petkov voiced his strong disapproval and criticized the code review shortcomings. Thanks to the swift action taken by both companies, the issue was resolved, and the Linux kernel 6.13 version was successfully launched. This event serves as a stark reminder to the Linux kernel community, emphasizing the crucial role and importance of rigorous code reviews.