Каноничный дистрибутив Linux жертвует безопасностью ради производительности! 🐧 Ubuntu официально отключил защиту от Spectre-атак для видеокарт Intel — и обещает скачок FPS до 20% в играх и приложениях.
Почему так: годами патчи «лечили» уязвимости CPU/GPU, но тормозили системы. Теперь команда Ubuntu решила, что геймплей важнее паранойи. Риск? Теоретически хакеры могут красть данные через дыры вроде Spectre, но в реальности атаки сложны.
Фишка: твик особенно порадует геймеров на Linux и всех, кто рендерит на интегрированной графике. Просто обновитесь — и наслаждайтесь скоростью. 🔥 И да, это временное решение, пока Intel не выпустит железо с «иммунитетом». Выбираете FPS или безопасность?
Some limitations apply Ubuntu disables Intel GPU security mitigations, promises 20% performance boost Overtime defenses for Spectre-based attacks have taken their toll. Dan Goodin – Jun 25, 2025 3:39 pm | 5 Credit:
Getty ImagesCredit:
Getty ImagesText settings Story text Size Small Standard Large Width
- Standard Wide Links Standard Orange
- Subscribers only Learn more Minimize to nav Ubuntu users could see up to a 20 percent boost in graphics performance on Intel-based systems under a change that will turn off security mitigations for blunting a class of attacks known as Spectre. Spectre, you may recall, came to public notice in 2018. Spectre attacks are based on the observation that performance enhancements built into modern CPUs open a side channel that can leak secrets a CPU is processing. The performance enhancement, known as speculative execution , predicts future instructions a CPU might receive and then performs the corresponding tasks before they are even called. If the instructions never come, the CPU discards the work it performed. When the prediction is correct, the CPU has already completed the task. By using code that forces a CPU to execute carefully selected instructions, Spectre attacks can extract confidential data that the CPU would have accessed had it carried out the ghost instructions. Over the past seven years, researchers have uncovered multiple attack variants based on the architectural flaws, which are unfixable. CPU manufacturers have responded by creating patches in both micro code and binary code that restrict speculative execution operations in certain scenarios. These restrictions, of course, usually degrade CPU performance. When the investment costs more than the return Over time, those mitigations have degraded graphics processing performance by as much as 20 percent, a member of the Ubuntu development team recently reported . Additionally, the team member said, Ubuntu will integrate many of the same mitigations directly into its Kernel, specifically in the Questing Quokka release scheduled for October. In consultation with their counterparts at Intel, Ubuntu security engineers have decided to disable the mitigations in the device driver for the Intel Graphics Compute Runtime . “After discussion between Intel and Canonical’s security teams, we are in agreement that Spectre no longer needs to be mitigated for the GPU at the Compute Runtime level,” Ubuntu developer Shane McKee wrote. He continued: At this point, Spectre has been mitigated in the kernel, and a clear warning from the Compute Runtime build serves as a notification for those running modified kernels without those patches. For these reasons, we feel that Spectre mitigations in Compute Runtime no longer offer enough security impact to justify the current performance tradeoff. McKee went on to say that as a result, “Users can expect up to 20% performance improvement.” The developer acknowledged that the change could open security holes or introduce bugs but said that both Ubuntu and Intel have confidence that disabled versions will be safe. Most of the researchers Ars consulted agreed. They reasoned that the mitigations built into the kernel are likely to protect against most if not all Spectre attack scenarios. They also noted that there are no known reports of Spectre attacks ever being actively used in the wild. “Nobody bothers attacking these vulns because it takes a lot of engineering time to implement attacks against them to any useful level of rigor, and getting any interesting data back outside very targeted scenarios is very unlikely (plus it’s noisy due to the number of iterations you need to do on these types of side-channels),” independent researcher Graham Sutherland wrote on Mastodon . “The economics just don’t stack up for attackers, especially when there are so many lower-effort higher-reward attack approaches they can throw at stuff.” “From the user perspective it’s risk/reward too,” a researcher going by the handle demize added . “Probably don’t disable side-channel mitigations on multitenant servers. …” But for typical users, “you have a much higher threat from downloading malware that does literally anything else.” Ultimately, cryptography engineer Sophie Schmieg said, the benefit of the mitigations isn’t worth the performance costs to GPU performance, where predicting instruction branches is more critical than for CPU performance. “The system can effectively parallelize a lot more actions without requiring expensive synchronization points between the cores,” Schmieg said . “If anything, something massively parallel like a GPU wants to do branch prediction even more liberally than a CPU.” One thing Ubuntu users should know is that the change will only provide performance boosts when GPUs are handling workloads running the OpenCL framework or the OneAPI Level Zero interface. That likely means that people using games and similar apps will see no benefit. Ubuntu users who run a custom Linux kernel without Spectre GPU mitigations should keep the compute runtime level mitigations on, a spokesman for Ubuntu developer Canonical said. These users can build a Compute Runtime themselves with the NEO_DISABLE_MITIGATIONS=false flag added. Dan Goodin Senior Security Editor Dan Goodin Senior Security Editor Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. In his spare time, he enjoys gardening, cooking, and following the independent music scene. Dan is based in San Francisco. Follow him at here on Mastodon and here on Bluesky. Contact him on Signal at DanArs.82. 5 Comments
