CVE-2022-26373

What it actually does

Non-transparent sharing of return predictor targets between contexts in some Intel processors allows an authorized local user to disclose sensitive information from other execution contexts via side-channel observation.

Why it matters to the business

Attackers with any local access could extract sensitive data such as encryption keys or credentials from other processes on the same system, increasing risk of data theft on shared or multi-tenant hosts; the issue affects many older Ubuntu kernel packages with a low but persistent exploitation probability.

How an attack unfolds

An attacker obtains local user access, runs code to train and probe the CPU return predictor across context switches, observes timing or state leakage to reconstruct data belonging to other processes or VMs, and repeats measurements to exfiltrate targeted secrets.

How to fix it

Upgrade affected packages to the listed fixed versions, for example linux 3.11.0-12.19 on Ubuntu 14.04 LTS, linux-aws 4.4.0-1002.2 on Ubuntu 14.04 LTS, linux 4.2.0-16.19 on Ubuntu 16.04 LTS, linux-hwe 4.8.0-36.36~16.04.1 on Ubuntu 16.04 LTS and equivalent updates for all other listed variants; apply current Intel microcode packages as well.

How to confirm the fix worked

Confirm installed kernel versions match or exceed the per-package fixed releases, verify microcode revision via dmesg or tools such as iucode-tool, and test that cross-context return-predictor leakage is no longer observable with vendor-provided validation utilities.

Typical attack path

1. Obtain local shell or code execution on a vulnerable system
2. Execute unprivileged code that manipulates return predictor state
3. Perform side-channel measurements across security boundaries
4. Aggregate observations to reconstruct sensitive data from other contexts

How to detect it

Review authentication and process execution logs for unexpected local interactive sessions followed by sustained high-frequency CPU activity; inspect for custom binaries or scripts performing return-address prediction measurements.

What your security team should do

• Apply the exact kernel package updates listed for each Ubuntu release immediately
• Restrict local access and isolate workloads on shared hosts until patches are deployed
• Monitor EPSS trend and any new exploit maturity reports for prioritization of remaining systems