doc: CVE-2018-3665 (Lazy FP State Restore (LazyFP)), unsupported

built from commit 6732eb141b
 dated 2026-04-19 12:49:17 +0200
 by Stéphane Lesimple (speed47_github@speed47.net)

.github/workflows/autoupdate.yml

@@ -0,0 +1,36 @@
+name: autoupdate
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '42 9 * * *'
+
+permissions:
+  pull-requests: write
+
+jobs:
+  autoupdate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install prerequisites
+        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends iucode-tool sqlite3 unzip
+      - name: Update microcode versions
+        run: ./spectre-meltdown-checker.sh --update-builtin-fwdb
+      - name: Check git diff
+        id: diff
+        run: |
+          echo change="$(git diff spectre-meltdown-checker.sh | awk '/MCEDB/ { if(V) { print V" to "$4; exit } else { V=$4 } }')" >> "$GITHUB_OUTPUT"
+          echo nbdiff="$(git diff spectre-meltdown-checker.sh | grep -cE -- '^\+# [AI],')" >> "$GITHUB_OUTPUT"
+          git diff
+          cat "$GITHUB_OUTPUT"
+      - name: Create Pull Request if needed
+        if: steps.diff.outputs.nbdiff != '0'
+        uses: peter-evans/create-pull-request@v7
+        with:
+          branch: autoupdate-fwdb
+          commit-message: "update: fwdb from ${{ steps.diff.outputs.change }}, ${{ steps.diff.outputs.nbdiff }} microcode changes"
+          title: "[Auto] Update fwdb from ${{ steps.diff.outputs.change }}"
+          body: |
+            Automated PR to update fwdb from ${{ steps.diff.outputs.change }}
+            Detected ${{ steps.diff.outputs.nbdiff }} microcode changes

.github/workflows/daily_vuln_scan_prompt.md

@@ -0,0 +1,199 @@
+# Daily transient-execution vulnerability scan
+
+You are a scheduled agent running inside a GitHub Actions job. Your job
+is to audit public news/advisory sources for **transient-execution and
+CPU side-channel vulnerabilities** that may need to be added to
+**spectre-meltdown-checker** (this repository).
+
+## What counts as "relevant"
+
+spectre-meltdown-checker detects, reports, and suggests mitigations for
+CPU vulnerabilities such as: Spectre v1/v2/v4, Meltdown, Foreshadow/L1TF,
+MDS (ZombieLoad/RIDL/Fallout), TAA, SRBDS, iTLB Multihit, Zenbleed,
+Downfall (GDS), Retbleed, Inception, SRSO, BHI, RFDS, Reptar, FP-DSS,
+and any similar microarchitectural side-channel or speculative-execution
+issue on x86 (Intel/AMD) or ARM CPUs. It also surfaces related hardware
+mitigation features (SMAP/SMEP/UMIP/IBPB/eIBRS/STIBP…) when they gate
+the remediation for a tracked CVE.
+
+It does **not** track generic software CVEs, GPU driver bugs, networking
+stacks, filesystem bugs, userspace crypto issues, or unrelated kernel
+subsystems.
+
+## Inputs handed to you by the workflow
+
+- Working directory: the repo root (`/github/workspace` in Actions, or
+  wherever `actions/checkout` placed it). You may `grep` the repo to
+  check whether a CVE or codename is already covered.
+- `state/seen.json` — memory carried over from the previous run, with
+  shape:
+
+  ```json
+  {
+    "last_run": "2026-04-17T08:00:12Z",
+    "seen": {
+      "<stable-id-1>": { "bucket": "unrelated", "seen_at": "2026-04-17T08:00:12Z", "source": "phoronix" },
+      "<stable-id-2>": { "bucket": "tocheck",   "seen_at": "2026-04-17T08:00:12Z", "source": "oss-sec", "cve": "CVE-2026-1234" }
+    }
+  }
+  ```
+
+  On the very first run, or when the prior artifact has expired,
+  the file exists but `seen` is empty and `last_run` is `null`.
+
+- Environment: `SCAN_DATE` (ISO-8601 timestamp of the run start, set by
+  the workflow). Treat this as "now" for all time-window decisions.
+
+## Time window
+
+This is a belt-and-suspenders design — use **both** mechanisms:
+
+1. **Primary: stable-id dedup.** If an item's stable identifier (see
+   below) is already present in `state.seen`, skip it entirely — it
+   was classified on a previous day.
+2. **Secondary: 25-hour window.** Among *new* items, prefer those whose
+   publication/update timestamp is within the last 25 h relative to
+   `SCAN_DATE`. This bounds work when the prior artifact expired
+   (90-day retention) or when `last_run` is stale (missed runs).
+   If `last_run` is older than 25 h, widen the window to
+   `now - last_run + 1h` so no items are lost across missed runs.
+3. Items without a parseable timestamp: include them (fail-safe).
+
+## Sources to poll
+
+Fetch each URL with
+`curl -sS -A "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36" -L --max-time 20`.
+On non-2xx or timeout, record the failure in the run summary and
+continue — do not abort.
+
+### RSS / Atom feeds (primary — parse feed timestamps)
+
+| Short name      | URL |
+|-----------------|-----|
+| phoronix        | https://www.phoronix.com/rss.php |
+| oss-sec         | https://seclists.org/rss/oss-sec.rss |
+| lwn             | https://lwn.net/headlines/newrss |
+| project-zero    | https://googleprojectzero.blogspot.com/feeds/posts/default |
+| vusec           | https://www.vusec.net/feed/ |
+| comsec-eth      | https://comsec.ethz.ch/category/news/feed/ |
+| msrc            | https://msrc.microsoft.com/update-guide/rss |
+| cisa            | https://www.cisa.gov/cybersecurity-advisories/all.xml |
+| cert-cc         | https://www.kb.cert.org/vuls/atomfeed/ |
+
+### HTML pages (no RSS — fetch, extract dated entries)
+
+| Short name      | URL |
+|-----------------|-----|
+| intel-psirt     | https://www.intel.com/content/www/us/en/security-center/default.html |
+| amd-psirt       | https://www.amd.com/en/resources/product-security.html |
+| arm-spec        | https://developer.arm.com/Arm%20Security%20Center/Speculative%20Processor%20Vulnerability |
+| transient-fail  | https://transient.fail/ |
+
+For HTML pages: look for advisory tables or listings with dates. Extract
+the advisory title, permalink, and date. If a page has no dates at all,
+compare its content against `state.seen` — any new advisory IDs not yet
+classified count as "new this run".
+
+## Stable identifier per source
+
+Use the first available of these, in order, as the dedup key:
+
+1. Vendor advisory ID (`INTEL-SA-01234`, `AMD-SB-7001`, `ARM-2024-0042`,
+   `VU#123456`, `CVE-YYYY-NNNNN`)
+2. RSS `<guid>` / Atom `<id>`
+3. Permalink URL (`<link>`)
+
+Always also record the permalink URL in the output file so a human can
+click through.
+
+## Classification rules
+
+For each **new** item (not in `state.seen`) that passes the time window,
+pick exactly one bucket:
+
+- **toimplement** — a clearly-identified new transient-execution / CPU
+  side-channel vulnerability in scope, **and not already covered by
+  this repo**. Verify the second half by grepping the repo for the CVE
+  ID *and* the codename before classifying; if either matches existing
+  code, demote to `tocheck`.
+- **tocheck** — plausibly in-scope but ambiguous: mitigation-only
+  feature (LASS, IBT, APIC-virt, etc.); item seemingly already
+  implemented but worth confirming scope; unclear applicability
+  (e.g. embedded-only ARM SKU); CVE-ID pending; contradictory info
+  across sources. State clearly what would resolve the ambiguity.
+- **unrelated** — everything else.
+
+Tie-breakers: prefer `tocheck` over `unrelated` when uncertain. Prefer
+`tocheck` over `toimplement` when the CVE ID is still "reserved" /
+"pending" — false positives in `toimplement` waste human time more than
+false positives in `tocheck`.
+
+## Outputs
+
+Compute `TODAY=$(date -u -d "$SCAN_DATE" +%F)`. Write these files under
+the repo root, overwriting if they already exist (they shouldn't unless
+the workflow re-ran the same day):
+
+- `rss_${TODAY}_toimplement.md`
+- `rss_${TODAY}_tocheck.md`
+- `rss_${TODAY}_unrelated.md`
+
+Each file uses level-2 headers per source short-name, then one bullet
+per item: the stable ID (if any), the permalink URL, and 1–2 sentences.
+Keep entries terse — a human skims these daily.
+
+```markdown
+## oss-sec
+- **CVE-2026-1234** — https://www.openwall.com/lists/oss-security/2026/04/18/3
+  New Intel transient-execution bug "Foo" disclosed today; affects
+  Redwood Cove cores, microcode fix pending. Not yet covered by this
+  repo (grepped for CVE-2026-1234 and "Foo" — no matches).
+
+## phoronix
+- https://www.phoronix.com/news/Some-Article
+  Linux 7.2 drops a compiler-target flag; unrelated to CPU side channels.
+```
+
+If a bucket has no items, write the file with a single line
+`(no new items in this window)` so it is obvious the job ran.
+
+### Run summary
+
+Append this block to the **tocheck** file (creating it if empty):
+
+```markdown
+## Run summary
+- SCAN_DATE: <value>
+- window cutoff: <computed cutoff>
+- prior state size: <N> entries, last_run=<value>
+- per-source new item counts: phoronix=<n>, oss-sec=<n>, lwn=<n>, ...
+- fetch failures: <list, or "none">
+- total classified this run: toimplement=<n>, tocheck=<n>, unrelated=<n>
+```
+
+### State update
+
+Rewrite `state/seen.json` with:
+
+- `last_run` = `SCAN_DATE`
+- `seen` = union of (pruned prior `seen`) ∪ (all items classified this
+  run, keyed by stable ID, with `{bucket, seen_at=SCAN_DATE, source, cve?}`)
+
+Pruning (keep state bounded): drop any entry whose `seen_at` is older
+than 30 days before `SCAN_DATE`. The workflow step also does this as
+a safety net, but do it here too so the in-memory view is consistent.
+
+## Guardrails
+
+- Do NOT modify any repo source code. Only write the three markdown
+  output files and `state/seen.json`.
+- Do NOT create commits, branches, or PRs.
+- Do NOT call any tool that posts externally (Slack, GitHub comments,
+  issues, email, etc.).
+- Do NOT follow links off-site for deeper investigation unless strictly
+  needed to resolve a `tocheck` ambiguity — budget of at most 5 such
+  follow-ups per run.
+- If a source returns unexpectedly large content, truncate to the first
+  ~200 items before parsing.
+- If total runtime exceeds 15 minutes, finish whatever you can,
+  write partial outputs, and note it in the run summary.

.github/workflows/stale.yml

@@ -0,0 +1,33 @@
+name: 'Manage stale issues and PRs'
+
+on:
+  schedule:
+    - cron: '37 7 * * *'
+  workflow_dispatch:
+    inputs:
+      action:
+        description: "dry-run"
+        required: true
+        default: "dryrun"
+        type: choice
+        options:
+          - dryrun
+          - apply
+
+permissions:
+  issues: write
+  pull-requests: write
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@v10
+        with:
+          any-of-labels: 'needs-more-info,answered'
+          labels-to-remove-when-unstale: 'needs-more-info,answered'
+          days-before-stale: 30
+          days-before-close: 7
+          stale-issue-label: stale
+          remove-stale-when-updated: true
+          debug-only: ${{ case(inputs.action == 'dryrun', true, false) }}

.github/workflows/vuln-scan.yml

@@ -0,0 +1,129 @@
+name: Online search for vulns
+
+on:
+  schedule:
+    - cron: '42 8 * * *'
+  workflow_dispatch: {}   # allow manual trigger
+
+permissions:
+  contents: read
+  actions: read           # needed to list/download previous run artifacts
+  id-token: write         # needed to mint OIDC token
+
+concurrency:
+  group: vuln-scan
+  cancel-in-progress: true
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - name: Checkout repository (for grep-based dedup against existing checks)
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      # ---- Load previous state ---------------------------------------------
+      # Find the most recent successful run of THIS workflow (other than the
+      # current one) and pull its `vuln-scan-state` artifact. On the very
+      # first run there will be none — that's fine, we start empty.
+      - name: Find previous successful run id
+        id: prev
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -e
+          run_id=$(gh run list \
+            --workflow="${{ github.workflow }}" \
+            --status=success \
+            --limit 1 \
+            --json databaseId \
+            --jq '.[0].databaseId // empty')
+          echo "run_id=${run_id}" >> "$GITHUB_OUTPUT"
+          if [ -n "$run_id" ]; then
+            echo "Found previous successful run: $run_id"
+          else
+            echo "No previous successful run — starting from empty state."
+          fi
+
+      - name: Download previous state artifact
+        if: steps.prev.outputs.run_id != ''
+        uses: actions/download-artifact@v4
+        continue-on-error: true   # tolerate retention expiry
+        with:
+          name: vuln-scan-state
+          path: state/
+          run-id: ${{ steps.prev.outputs.run_id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Ensure state file exists
+        run: |
+          mkdir -p state
+          if [ ! -f state/seen.json ]; then
+            echo '{"last_run": null, "seen": {}}' > state/seen.json
+            echo "Initialized empty state."
+          fi
+          echo "State size: $(wc -c < state/seen.json) bytes"
+
+      # ---- Run the scan ----------------------------------------------------
+      # Runs Claude Code against daily_vuln_scan_prompt.md.
+      # That prompt file fully specifies: sources to poll, how to read
+      # state/seen.json, the 25-hour window, the output files to write,
+      # and how to rewrite state/seen.json at the end of the run.
+      - name: Research for online mentions of new vulns
+        id: scan
+        uses: anthropics/claude-code-action@v1
+        env:
+          SCAN_DATE: ${{ github.run_started_at }}
+        with:
+          claude_args: |
+            --model claude-opus-4-7 --allowedTools "Read,Write,Edit,Bash,Grep,Glob,WebFetch"
+          prompt: |
+            Read the full task instructions from .github/workflows/daily_vuln_scan_prompt.md and execute them end-to-end. That file fully specifies: sources to poll, how to read and update state/seen.json, the 25-hour window, which rss_YYYY-MM-DD_*.md files to write, and the run guardrails. Use $SCAN_DATE (env var) as "now" for time-window decisions.
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+
+      - name: Upload Claude execution log
+        if: ${{ always() && steps.scan.outputs.execution_file != '' }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: claude-execution-log-${{ github.run_id }}
+          path: ${{ steps.scan.outputs.execution_file }}
+          retention-days: 30
+          if-no-files-found: warn
+
+      # ---- Persist outputs -------------------------------------------------
+      - name: Prune state (keep only entries from the last 30 days)
+        run: |
+          python3 - <<'PY'
+          import json, datetime, pathlib
+          p = pathlib.Path("state/seen.json")
+          data = json.loads(p.read_text())
+          cutoff = (datetime.datetime.utcnow() - datetime.timedelta(days=30)).isoformat()
+          before = len(data.get("seen", {}))
+          data["seen"] = {
+              k: v for k, v in data.get("seen", {}).items()
+              if v.get("seen_at", "9999") >= cutoff
+          }
+          after = len(data["seen"])
+          p.write_text(json.dumps(data, indent=2, sort_keys=True))
+          print(f"Pruned state: {before} -> {after} entries")
+          PY
+
+      - name: Upload new state artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: vuln-scan-state
+          path: state/seen.json
+          retention-days: 90
+          if-no-files-found: error
+
+      - name: Upload daily report
+        uses: actions/upload-artifact@v4
+        with:
+          name: vuln-scan-report-${{ github.run_id }}
+          path: rss_*.md
+          retention-days: 90
+          if-no-files-found: warn

FAQ.md

@@ -1,145 +0,0 @@
-# Questions
-
-- [What to expect from this tool?](#what-to-expect-from-this-tool)
-- [Why was this script written in the first place?](#why-was-this-script-written-in-the-first-place)
-- [Why are those vulnerabilities so different than regular CVEs?](#why-are-those-vulnerabilities-so-different-than-regular-cves)
-- [What do "affected", "vulnerable" and "mitigated" mean exactly?](#what-do-affected-vulnerable-and-mitigated-mean-exactly)
-- [What are the main design decisions regarding this script?](#what-are-the-main-design-decisions-regarding-this-script)
-- [Everything is indicated in `sysfs` now, is this script still useful?](#everything-is-indicated-in-sysfs-now-is-this-script-still-useful)
-- [How does this script work?](#how-does-this-script-work)
-- [Which BSD OSes are supported?](#which-bsd-oses-are-supported)
-- [Why is my OS not supported?](#why-is-my-os-not-supported)
-- [The tool says there is an updated microcode for my CPU, but I don't have it!](#the-tool-says-there-is-an-updated-microcode-for-my-cpu-but-i-dont-have-it)
-- [The tool says that I need a more up-to-date microcode, but I have the more recent version!](#the-tool-says-that-i-need-a-more-up-to-date-microcode-but-i-have-the-more-recent-version)
-- [Which rules are governing the support of a CVE in this tool?](#which-rules-are-governing-the-support-of-a-cve-in-this-tool)
-
-# Answers
-
-## What to expect from this tool?
-
-This tool does its best to determine where your system stands on each of the collectively named [transient execution](https://en.wikipedia.org/wiki/Transient_execution_CPU_vulnerability) vulnerabilities (also sometimes called "speculative execution" vulnerabilities) that were made public since early 2018. It doesn't attempt to run any kind of exploit, and can't guarantee that your system is secure, but rather helps you verifying if your system is affected, and if it is, checks whether it has the known mitigations in place to avoid being vulnerable.
-Some mitigations could also exist in your kernel that this script doesn't know (yet) how to detect, or it might falsely detect mitigations that in the end don't work as expected (for example, on backported or modified kernels).
-
-Please also note that for Spectre vulnerabilities, all software can possibly be exploited, this tool only verifies that the kernel (which is the core of the system) you're using has the proper protections in place. Verifying all the other software is out of the scope of this tool. As a general measure, ensure you always have the most up to date stable versions of all the software you use, especially for those who are exposed to the world, such as network daemons and browsers.
-
-This tool has been released in the hope that it'll be useful, but don't use it to jump to definitive conclusions about your security: hardware vulnerabilities are [complex beasts](#why-are-those-vulnerabilities-so-different-than-regular-cves), and collective understanding of each vulnerability is evolving with time.
-
-## Why was this script written in the first place?
-
-The first commit of this script is dated *2018-01-07*, only 4 days after the world first heard about the Meltdown and the Spectre attacks. With those attacks disclosure, a _whole new range of vulnerabilities_ that were previously thought to be mostly theoretical and only possible in very controlled environments (labs) - hence of little interest for most except researchers - suddenly became completely mainstream and apparently trivial to conduct on an immensely large number of systems.
-
-On the few hours and days after that date, the whole industry went crazy. Proper, verified information about these vulnerabilities was incredibly hard to find, because before this, even the CPU vendors never had to deal with managing security vulnerabilities at scale, as software vendors do since decades. There were a lot of FUD, and the apparent silence of the vendors was enough for most to fear the worst. The whole industry had everything to learn about this new type of vulnerabilities. However, most systems administrators had a few simple questions:
-
-- Am **I** vulnerable? And if yes,
-- What do I have to do to mitigate these vulnerabilities on **my** system?
-
-Unfortunately, answering those questions was very difficult (and still is to some extent), even if the safe answer to the first question was "you probably are". This script was written to try to give simple answers to those simple questions, and was made to evolve as the information about these vulnerabilities became available. On the first few days, there was several new versions published **per day**.
-
-## Why are those vulnerabilities so different than regular CVEs?
-
-Those are hardware vulnerabilities, while most of the CVEs we see everyday are software vulnerabilities. A quick comparison would be:
-
-Software vulnerability:
-- Can be fixed? Yes.
-- How to fix? Update the software (or uninstall it!)
-
-Hardware vulnerability:
-- Can be fixed? No, only mitigated (or buy new hardware!)
-- How to ~~fix~~ mitigate? In the worst case scenario, 5 "layers" need to be updated: the microcode/firmware, the host OS kernel, the hypervisor, the VM OS kernel, and possibly all the software running on the machine. Sometimes only a subset of those layers need to be updated. In yet other cases, there can be several possible mitigations for the same vulnerability, implying different layers. Yes, it can get horribly complicated.
-
-A more detailed video explanation is available here: https://youtu.be/2gB9U1EcCss?t=425
-
-## What do "affected", "vulnerable" and "mitigated" mean exactly?
-
-- **Affected** means that your CPU's hardware, as it went out of the factory, is known to be concerned by a specific vulnerability, i.e. the vulnerability applies to your hardware model. Note that it says nothing about whether a given vulnerability can actually be used to exploit your system. However, an unaffected CPU will never be vulnerable, and doesn't need to have mitigations in place.
-- **Vulnerable** implies that you're using an **affected** CPU, and means that a given vulnerability can be exploited on your system, because no (or insufficient) mitigations are in place.
-- **Mitigated** implies that a previously **vulnerable** system has followed all the steps (updated all the required layers) to ensure a given vulnerability cannot be exploited. About what "layers" mean, see [the previous question](#why-are-those-vulnerabilities-so-different-than-regular-cves).
-
-## What are the main design decisions regarding this script?
-
-There are a few rules that govern how this tool is written.
-
-1) It should be okay to run this script in a production environment. This implies, but is not limited to:
-
-   * 1a. Never modify the system it's running on, and if it needs to e.g. load a kernel module it requires, that wasn't loaded before it was launched, it'll take care to unload it on exit
-   * 1b. Never attempt to "fix" or "mitigate" any vulnerability, or modify any configuration. It just reports what it thinks is the status of your system. It leaves all decisions to the sysadmin.
-   * 1c. Never attempt to run any kind of exploit to tell whether a vulnerability is mitigated, because it would violate 1a), could lead to unpredictable system behavior, and might even lead to wrong conclusions, as some PoC must be compiled with specific options and prerequisites, otherwise giving wrong information (especially for Spectre). If you want to run PoCs, do it yourself, but please read carefully about the PoC and the vulnerability. PoCs about a hardware vulnerability are way more complicated and prone to false conclusions than PoCs for software vulnerabilities.
-
-2) Never look at the kernel version to tell whether it supports mitigation for a given vulnerability. This implies never hardcoding version numbers in the script. This would defeat the purpose: this script should be able to detect mitigations in unknown kernels, with possibly backported or forward-ported patches. Also, don't believe what `sysfs` says, when possible. See the next question about this.
-
-3) Never look at the microcode version to tell whether it has the proper mechanisms in place to support mitigation for a given vulnerability. This implies never hardcoding version numbers in the script. Instead, look for said mechanisms, as the kernel would do.
-
-4) When a CPU is not known to be explicitly unaffected by a vulnerability, make the assumption that it is. This strong design choice has it roots in the early speculative execution vulnerability days (see [this answer](#why-was-this-script-written-in-the-first-place)), and is still a good approach as of today.
-
-## Everything is indicated in `sysfs` now, is this script still useful?
-
-A lot as changed since 2018. Nowadays, the industry adapted and this range of vulnerabilities is almost "business as usual", as software vulnerabilities are. However, due to their complexity, it's still not as easy as just checking a version number to ensure a vulnerability is closed.
-
-Granted, we now have a standard way under Linux to check whether our system is affected, vulnerable, mitigated against most of these vulnerabilities. By having a look at the `sysfs` hierarchy, and more precisely the `/sys/devices/system/cpu/vulnerabilities/` folder, one can have a pretty good insight about its system state for each of the listed vulnerabilities. Note that the output can be a little different with some vendors (e.g. Red Hat has some slightly different output than the vanilla kernel for some vulnerabilities), but it's still a gigantic leap forward, given where we were in 2018 when this script was started, and it's very good news. The kernel is the proper place to have this because the kernel knows everything about itself (the mitigations it might have), and the CPU (its model, and microcode features that are exposed). Note however that some vulnerabilities are not reported through this file hierarchy at all, such as Zenbleed.
-
-However I see a few reasons why this script might still be useful to you, and that's why its development has not halted when the `sysfs` hierarchy came out:
-
-- A given version of the kernel doesn't have knowledge about the future. To put it in another way: a given version of the kernel only has the understanding of a vulnerability available at the time it was compiled. Let me explain this: when a new vulnerability comes out, new versions of the microcode and kernels are released, with mitigations in place. With such a kernel, a new `sysfs` entry will appear. However, after a few weeks or months, corner cases can be discovered, previously-thought unaffected CPUs can turn out to be affected in the end, and sometimes mitigations can end up being insufficient.  Of course, if you're always running the latest kernel version from kernel.org, this issue might be limited for you. The spectre-meltdown-checker script doesn't depend on a kernel's knowledge and understanding of a vulnerability to compute its output. That is, unless you tell it to (using the `--sysfs-only` option).
-
-- Mitigating a vulnerability completely can sometimes be tricky, and have a lot of complicated prerequisites, depending on your kernel version, CPU vendor, model and even sometimes stepping, CPU microcode, hypervisor support, etc. The script gives a very detailed insight about each of the prerequisites of mitigation for every vulnerability, step by step, hence pointing out what is missing on your system as a whole to completely mitigate an issue.
-
-- The script can be pointed at a kernel image, and will deep dive into it, telling you if this kernel will mitigate vulnerabilities that might be present on your system. This is a good way to verify before booting a new kernel, that it'll mitigate the vulnerabilities you expect it to, especially if you modified a few config options around these topics.
-
-- The script will also work regardless of the custom patches that might be integrated in the kernel you're running (or you're pointing it to, in offline mode), and completely ignores the advertised kernel version, to tell whether a given kernel mitigates vulnerabilities. This is especially useful for non-vanilla kernel, where patches might be backported, sometimes silently (this has already happened, too).
-
-- Educational purposes: the script gives interesting insights about a vulnerability, and how the different parts of the system work together to mitigate it.
-
-There are probably other reasons, but that are the main ones that come to mind. In the end, of course, only you can tell whether it's useful for your use case ;)
-
-## How does this script work?
-
-On one hand, the script gathers information about your CPU, and the features exposed by its microcode. To do this, it uses the low-level CPUID instruction (through the `cpuid` kernel module under Linux, and the `cpucontrol` tool under BSD), and queries to the MSR registers of your CPU (through the `msr` kernel module under Linux, and the `cpucontrol` tool under BSD).
-
-On another hand, the script looks into the kernel image your system is running on, for clues about the mitigations it supports. Of course, this is very specific for each operating system, even if the implemented mitigation is functionally the same, the actual code is completely specific. As you can imagine, the Linux kernel code has a few in common with a BSD kernel code, for example. Under Linux, the script supports looking into the kernel image, and possibly the System.map and kernel config file, if these are available. Under BSD, it looks into the kernel file only.
-
-Then, for each vulnerability it knows about, the script decides whether your system is [affected, vulnerable, and mitigated](#what-do-affected-vulnerable-and-mitigated-mean-exactly) against it, using the information it gathered about your hardware and your kernel.
-
-## Which BSD OSes are supported?
-
-For the BSD range of operating systems, the script will work as long as the BSD you're using supports `cpuctl` and `linprocfs`. This is not the case for OpenBSD for example. Known BSD flavors having proper support are: FreeBSD, NetBSD, DragonflyBSD. Derivatives of those should also work. To know why other BSDs will likely never be supported, see [why is my OS not supported?](#why-is-my-os-not-supported).
-
-## Why is my OS not supported?
-
-This tool only supports Linux, and [some flavors of BSD](#which-bsd-oses-are-supported). Other OSes will most likely never be supported, due to [how this script works](#how-does-this-script-work). It would require implementing these OSes specific way of querying the CPU. It would also require to get documentation (if available) about how this OS mitigates each vulnerability, down to this OS kernel code, and if documentation is not available, reverse-engineer the difference between a known old version of a kernel, and a kernel that mitigates a new vulnerability. This means that all the effort has to be duplicated times the number of supported OSes, as everything is specific, by construction. It also implies having a deep understanding of every OS, which takes years to develop. However, if/when other tools appear for other OSes, that share the same goal of this one, they might be listed here as a convenience.
-
-## The tool says there is an updated microcode for my CPU, but I don't have it!
-
-Even if your operating system is fully up to date, the tool might still tell you that there is a more recent microcode version for your CPU. Currently, it uses (and merges) information from 4 sources:
-
-- The official [Intel microcode repository](https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files)
-- The awesome platomav's [MCExtractor database](https://github.com/platomav/MCExtractor) for non-Intel CPUs
-- The official [linux-firmware](https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git) repository for AMD
-- Specific Linux kernel commits that sometimes hardcode microcode versions, such as for [Zenbleed](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=522b1d69219d8f083173819fde04f994aa051a98) or for the bad [Spectre](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/x86/kernel/cpu/intel.c#n141) microcodes
-
-Generally, it means a more recent version of the microcode has been seen in the wild. However, fully public availability of this microcode might be limited yet, or your OS vendor might have chosen not to ship this new version (yet), maybe because it's currently being tested, or for other reasons. This tool can't tell you when or if this will be the case. You should ask your vendor about it. Technically, you can still go and upgrade your microcode yourself, and use this tool to confirm whether you did it successfully. Updating the microcode for you is out of the scope of this tool, as this would violate [rule 1b](#what-are-the-main-design-decisions-regarding-this-script).
-
-## The tool says that I need a more up-to-date microcode, but I have the more recent version!
-
-This can happen for a few reasons:
-
-- Your CPU is no longer supported by the vendor. In that case, new versions of the microcode will never be published, and vulnerabilities requiring microcode features will never be fixed. On most of these vulnerabilities, you'll have no way to mitigate the issue on a vulnerable system, appart from buying a more recent CPU. Sometimes, you might be able to mitigate the issue by disabling a CPU feature instead (often at the cost of speed). When this is the case, the script will list this as one of the possible mitigations for the vulnerability.
-
-- The vulnerability is recent, and your CPU has not yet received a microcode update for the vendor. Often, these updates come in batches, and it can take several batches to cover all the supported CPUs.
-
-In both cases, you can contact your vendor to know whether there'll be an update or not, and if yes, when. For Intel, at the time this FAQ entry was written, such guidance was [available here](https://software.intel.com/content/www/us/en/develop/topics/software-security-guidance/processors-affected-consolidated-product-cpu-model.html).
-
-## Which rules are governing the support of a CVE in this tool?
-
-On the early days, it was easy: just Spectre and Meltdown (hence the tool name), because that's all we had. Now that this range of vulnerability is seeing a bunch of newcomers every year, this question is legitimate.
-
-To stick with this tool's goal, a good indication as to why a CVE should be supported, is when mitigating it requires either kernel modifications, microcode modifications, or both.
-
-Counter-examples include (non-exhaustive list):
-
-- [CVE-2019-14615](https://github.com/speed47/spectre-meltdown-checker/issues/340), mitigating this issue is done by updating the Intel driver. This is out of the scope of this tool.
-- [CVE-2019-15902](https://github.com/speed47/spectre-meltdown-checker/issues/304), this CVE is due to a bad backport in the stable kernel. If the faulty backport was part of the mitigation of another supported CVE, and this bad backport was detectable (without hardcoding kernel versions, see [rule 2](#why-are-those-vulnerabilities-so-different-than-regular-cves)), it might have been added as a bullet point in the concerned CVE's section in the tool. However, this wasn't the case.
-- The "[Take A Way](https://github.com/speed47/spectre-meltdown-checker/issues/344)" vulnerability, AMD said that they believe this is not a new attack, hence there were no microcode and no kernel modification made. As there is nothing to look for, this is out of the scope of this tool.
-- [CVE-2020-0550](https://github.com/speed47/spectre-meltdown-checker/issues/347), the vendor thinks this is hardly exploitable in the wild, and as mitigations would be too performance impacting, as a whole the industry decided to not address it. As there is nothing to check for, this is out of the scope of this tool.
-- [CVE-2020-0551](https://github.com/speed47/spectre-meltdown-checker/issues/348), the industry decided to not address it, as it is believed mitigations for other CVEs render this attack practically hard to make, Intel just released an updated SDK for SGX to help mitigate the issue, but this is out of the scope of this tool.
-
-Look for the [information](https://github.com/speed47/spectre-meltdown-checker/issues?q=is%3Aissue+is%3Aopen+label%3Ainformation) tag in the issues list for more examples.

doc/batch_json.md

@@ -102,9 +102,7 @@ boundaries by a malicious guest.  Prioritise remediation where
 
 ### `cpu`
 
-CPU hardware identification.  `null` when `--no-hw` is active, or when
-`--arch-prefix` is set (host CPU info is then suppressed to avoid mixing
-with a different-arch target kernel).
+CPU hardware identification.  `null` when `--no-hw` is active.
 
 The object uses `arch` as a discriminator: `"x86"` for Intel/AMD/Hygon CPUs,
 `"arm"` for ARM/Cavium/Phytium.  Arch-specific fields live under a matching
@@ -142,7 +140,7 @@ fields from the other architecture.
 
 #### `cpu.x86.capabilities`
 
-Every capability is a **tri-state**: `true` (present), `false` (absent), or
+Each capability is a **tri-state**: `true` (present), `false` (absent), or
 `null` (not applicable or could not be read, e.g. when not root or on AMD for
 Intel-specific features).
 
@@ -240,7 +238,7 @@ with an unknown CVE ID).
 | `status` | string | `"OK"` / `"VULN"` / `"UNK"` | Check outcome (see below) |
 | `vulnerable` | boolean \| null | `false` / `true` / `null` | `false`=OK, `true`=VULN, `null`=UNK |
 | `info` | string | | Human-readable description of the specific mitigation state or reason |
-| `sysfs_status` | string \| null | `"OK"` / `"VULN"` / `"UNK"` / null | Status as reported by the kernel via `/sys/devices/system/cpu/vulnerabilities/`; null if sysfs was not consulted for this CVE, or if the CVE's check read sysfs in silent/quiet mode (raw message is still captured in `sysfs_message`) |
+| `sysfs_status` | string \| null | `"OK"` / `"VULN"` / `"UNK"` / null | Status as reported by the kernel via `/sys/devices/system/cpu/vulnerabilities/`; null if sysfs was not consulted for this CVE |
 | `sysfs_message` | string \| null | | Raw text from the sysfs file (e.g. `"Mitigation: PTI"`); null if sysfs was not consulted |
 
 #### Status values

doc/batch_json.schema.json

@@ -127,7 +127,7 @@
     },
 
     "cpu": {
-      "description": "CPU hardware identification. Null when --no-hw is active or when --arch-prefix is set (host CPU info is then suppressed to avoid mixing with a different-arch target kernel). Contains an 'arch' discriminator ('x86' or 'arm') and a matching arch-specific sub-object with identification fields and capabilities.",
+      "description": "CPU hardware identification. Null when --no-hw is active. Contains an 'arch' discriminator ('x86' or 'arm') and a matching arch-specific sub-object with identification fields and capabilities.",
       "oneOf": [
         { "type": "null" },
         {
@@ -180,16 +180,16 @@
                   "type": ["string", "null"]
                 },
                 "capabilities": {
-                  "description": "CPU feature flags detected via CPUID and MSR reads. Every value is tri-state: true=present, false=absent, null=not applicable or unreadable.",
+                  "description": "CPU feature flags detected via CPUID and MSR reads. Each value is true (present), false (absent), or null (not applicable or could not be read).",
                   "type": "object",
                   "additionalProperties": false,
                   "properties": {
                     "spec_ctrl":                      { "type": ["boolean", "null"], "description": "SPEC_CTRL MSR present (Intel; enables IBRS + IBPB via WRMSR)" },
-                    "ibrs":                           { "type": ["boolean", "null"], "description": "IBRS supported (via SPEC_CTRL, IBRS_SUPPORT, or cpuinfo fallback)" },
-                    "ibpb":                           { "type": ["boolean", "null"], "description": "IBPB supported (via SPEC_CTRL, IBPB_SUPPORT, or cpuinfo fallback)" },
+                    "ibrs":                           { "type": ["boolean", "null"], "description": "Indirect Branch Restricted Speculation" },
+                    "ibpb":                           { "type": ["boolean", "null"], "description": "Indirect Branch Prediction Barrier" },
                     "ibpb_ret":                       { "type": ["boolean", "null"], "description": "IBPB on return (enhanced form)" },
-                    "stibp":                          { "type": ["boolean", "null"], "description": "STIBP supported (Intel/AMD/HYGON or cpuinfo fallback)" },
-                    "ssbd":                           { "type": ["boolean", "null"], "description": "SSBD supported (SPEC_CTRL, VIRT_SPEC_CTRL, non-architectural MSR, or cpuinfo fallback)" },
+                    "stibp":                          { "type": ["boolean", "null"], "description": "Single Thread Indirect Branch Predictors" },
+                    "ssbd":                           { "type": ["boolean", "null"], "description": "Speculative Store Bypass Disable" },
                     "l1d_flush":                      { "type": ["boolean", "null"], "description": "L1D cache flush instruction" },
                     "md_clear":                       { "type": ["boolean", "null"], "description": "VERW clears CPU buffers (MDS mitigation)" },
                     "arch_capabilities":              { "type": ["boolean", "null"], "description": "IA32_ARCH_CAPABILITIES MSR is present" },
@@ -231,7 +231,7 @@
                     "tsa_l1_no":                      { "type": ["boolean", "null"], "description": "Not susceptible to TSA-L1" },
                     "verw_clear":                     { "type": ["boolean", "null"], "description": "VERW clears CPU buffers" },
                     "autoibrs":                       { "type": ["boolean", "null"], "description": "AMD AutoIBRS (equivalent to enhanced IBRS on Intel)" },
-                    "sbpb":                           { "type": ["boolean", "null"], "description": "Selective Branch Predictor Barrier (AMD Inception mitigation): true if PRED_CMD MSR SBPB bit write succeeded; false if write failed; null if not verifiable (non-root, CPUID error, or CPU does not report SBPB support)" },
+                    "sbpb":                           { "type": ["boolean", "null"], "description": "Selective Branch Predictor Barrier (AMD Inception mitigation)" },
                     "avx2":                           { "type": ["boolean", "null"], "description": "AVX2 supported (relevant to Downfall / GDS)" },
                     "avx512":                         { "type": ["boolean", "null"], "description": "AVX-512 supported (relevant to Downfall / GDS)" }
                   }

doc/batch_nrpe.md

@@ -51,7 +51,6 @@ STATUS: summary | perfdata
 | VULN + UNK | `N/T CVE(s) vulnerable: CVE-A CVE-B ..., M inconclusive` |
 | UNK only | `N/T CVE checks inconclusive` |
 | Non-root + VULN | `N/T CVE(s) appear vulnerable (unconfirmed, not root): CVE-A ...` |
-| Non-root + VULN + UNK | `N/T CVE(s) appear vulnerable (unconfirmed, not root): CVE-A ..., M inconclusive` |
 
 ### Lines 2+ (long output)
 
@@ -60,19 +59,15 @@ Never parsed by the monitoring core; safe to add or reorder.
 
 #### Context notes
 
-Printed before per-CVE details when applicable.  Notes are emitted in this
-order when more than one applies:
+Printed before per-CVE details when applicable:
 
 | Note | Condition |
 |---|---|
 | `NOTE: paranoid mode active, stricter mitigation requirements applied` | `--paranoid` was used |
-| `NOTE: hypervisor host detected (reason); L1TF/MDS severity is elevated` | System is detected as a VM host (KVM, Xen, VMware…) |
+| `NOTE: hypervisor host detected (reason); L1TF/MDS severity is elevated` | System is a VM host (KVM, Xen, VMware…) |
 | `NOTE: not a hypervisor host` | System is confirmed not a VM host |
 | `NOTE: not running as root; MSR reads skipped, results may be incomplete` | Script ran without root privileges |
 
-When VMM detection did not run (e.g. `--no-hw`), neither the
-`hypervisor host detected` nor the `not a hypervisor host` note is printed.
-
 #### Per-CVE detail lines
 
 One line per non-OK CVE.  VULN entries (`[CRITICAL]`) appear before UNK

doc/batch_prometheus.md

@@ -90,16 +90,13 @@ smc_build_info{version="25.30.0250400123",mode="live",run_as_root="true",paranoi
 
 Operating system and kernel metadata.  Always value `1`.
 
-Absent entirely when none of `kernel_release`, `kernel_arch`, or
-`hypervisor_host` can be determined (e.g. non-live mode with no VMM detection).
-Each label is emitted only when its value is known; missing labels are
-omitted rather than set to an empty string.
+Absent in offline mode when neither `uname -r` nor `uname -m` is available.
 
 | Label | Values | Meaning |
 |---|---|---|
-| `kernel_release` | string | Output of `uname -r`; emitted only in live mode |
-| `kernel_arch` | string | Output of `uname -m`; emitted only in live mode |
-| `hypervisor_host` | `true` / `false` | Whether this machine is detected as a hypervisor host (running KVM, Xen, VMware, etc.); absent when VMM detection did not run (e.g. `--no-hw`) |
+| `kernel_release` | string | Output of `uname -r` (live mode only) |
+| `kernel_arch` | string | Output of `uname -m` (live mode only) |
+| `hypervisor_host` | `true` / `false` | Whether this machine is detected as a hypervisor host (running KVM, Xen, VMware, etc.) |
 
 **Example:**
 ```
@@ -117,47 +114,26 @@ a malicious guest.  Always prioritise remediation on hosts where
 ### `smc_cpu_info`
 
 CPU hardware and microcode metadata.  Always value `1`.  Absent when `--no-hw`
-is used or when `--arch-prefix` is set (host CPU info is suppressed to avoid
-mixing with a different-arch target kernel).
-
-Common labels (always emitted when the data is available):
+is used.
 
 | Label | Values | Meaning |
 |---|---|---|
-| `vendor` | string | CPU vendor (e.g. `GenuineIntel`, `AuthenticAMD`, `HygonGenuine`, `ARM`) |
+| `vendor` | string | CPU vendor (e.g. `Intel`, `AuthenticAMD`) |
 | `model` | string | CPU friendly name from `/proc/cpuinfo` |
-| `arch` | `x86` / `arm` | Architecture family; determines which arch-specific labels follow |
-| `smt` | `true` / `false` | Whether SMT (HyperThreading) is currently enabled; absent if undeterminable |
-| `microcode` | hex string | Installed microcode version (e.g. `0xf4`); absent if unreadable |
-| `microcode_latest` | hex string | Latest known-good microcode version from the firmware database; absent if the CPU is not in the database |
-| `microcode_up_to_date` | `true` / `false` | Whether `microcode == microcode_latest`; absent if either is unavailable |
-| `microcode_blacklisted` | `true` / `false` | Whether the installed microcode is known to cause problems and should be rolled back; emitted whenever `microcode` is emitted |
-
-x86-only labels (emitted when `arch="x86"`):
-
-| Label | Values | Meaning |
-|---|---|---|
 | `family` | integer string | CPU family number |
 | `model_id` | integer string | CPU model number |
 | `stepping` | integer string | CPU stepping number |
-| `cpuid` | hex string | Full CPUID value (e.g. `0x000906ed`) |
-| `codename` | string | Intel CPU codename (e.g. `Coffee Lake`); absent on AMD/Hygon |
+| `cpuid` | hex string | Full CPUID value (e.g. `0x000906ed`); absent on some ARM CPUs |
+| `codename` | string | Intel CPU codename (e.g. `Coffee Lake`); absent on AMD and ARM |
+| `smt` | `true` / `false` | Whether SMT (HyperThreading) is currently enabled |
+| `microcode` | hex string | Installed microcode version (e.g. `0xf4`) |
+| `microcode_latest` | hex string | Latest known-good microcode version from the firmware database |
+| `microcode_up_to_date` | `true` / `false` | Whether `microcode == microcode_latest` |
+| `microcode_blacklisted` | `true` / `false` | Whether the installed microcode is known to cause problems and should be rolled back |
 
-ARM-only labels (emitted when `arch="arm"`):
-
-| Label | Values | Meaning |
-|---|---|---|
-| `part_list` | string | Space-separated list of ARM part numbers across cores (e.g. `0xd0b 0xd05` on big.LITTLE) |
-| `arch_list` | string | Space-separated list of ARM architecture levels across cores (e.g. `8 8`) |
-
-**x86 example:**
+**Example:**
 ```
-smc_cpu_info{vendor="GenuineIntel",model="Intel(R) Core(TM) i7-9700K CPU @ 3.60GHz",arch="x86",family="6",model_id="158",stepping="13",cpuid="0x000906ed",codename="Coffee Lake",smt="true",microcode="0xf4",microcode_latest="0xf4",microcode_up_to_date="true",microcode_blacklisted="false"} 1
-```
-
-**ARM example:**
-```
-smc_cpu_info{vendor="ARM",model="ARM v8 model 0xd0b",arch="arm",part_list="0xd0b 0xd05",arch_list="8 8",smt="false"} 1
+smc_cpu_info{vendor="Intel",model="Intel(R) Core(TM) i7-9700K CPU @ 3.60GHz",family="6",model_id="158",stepping="13",cpuid="0x000906ed",codename="Coffee Lake",smt="true",microcode="0xf4",microcode_latest="0xf4",microcode_up_to_date="true",microcode_blacklisted="false"} 1
 ```
 
 **Microcode labels:**
@@ -376,15 +352,9 @@ queries.  CVE checks that rely on hardware capability detection (`cap_*` flags,
 MSR reads) will report `unknown` status.  `mode="no-hw"` in `smc_build_info`
 signals this.
 
-**Cross-arch inspection (`--arch-prefix`)**
-When a cross-arch toolchain prefix is passed, the script suppresses the host
-CPU metadata so it does not get mixed with data from a different-arch target
-kernel: `smc_cpu_info` is not emitted, the same as under `--no-hw`.
-
 **Hardware-only mode (`--hw-only`)**
 Only hardware detection is performed; CVE checks are skipped.  `smc_cpu_info`
-is emitted but no `smc_vulnerability_status` metrics appear (and
-`smc_vulnerable_count` / `smc_unknown_count` are `0`).  `mode="hw-only"` in
+is emitted but no `smc_vuln` metrics appear.  `mode="hw-only"` in
 `smc_build_info` signals this.
 
 **`--sysfs-only`**

spectre-meltdown-checker.sh

@@ -13,7 +13,7 @@
 #
 # Stephane Lesimple
 #
-VERSION='26.33.0420460'
+VERSION='26.33.0419451'
 
 # --- Common paths and basedirs ---
 readonly VULN_SYSFS_BASE="/sys/devices/system/cpu/vulnerabilities"
@@ -2402,17 +2402,15 @@ _prom_escape() {
     printf '%s' "$1" | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g' | tr '\n' ' '
 }
 
-# Convert a shell capability value to a JSON boolean token
-# Args: $1=value (1=true, 0=false, -1/empty=null, any other non-empty string=true)
-# Prints: JSON token (true/false/null)
-# Note: capability variables can be set to arbitrary strings internally to carry
-# detection-path context (e.g. cap_ssbd='Intel SSBD'); for the JSON output those
-# are normalized to true so consumers see a clean boolean | null type.
+# Convert a shell capability value to a JSON token
+# Args: $1=value (1=true, 0=false, -1/empty=null, other string=quoted string)
+# Prints: JSON token
 _json_cap() {
     case "${1:-}" in
+        1) printf 'true' ;;
         0) printf 'false' ;;
         -1 | '') printf 'null' ;;
-        *) printf 'true' ;;
+        *) printf '"%s"' "$(_json_escape "$1")" ;;
     esac
 }
 
@@ -2515,7 +2513,7 @@ _build_json_system() {
 # Sets: g_json_cpu
 # shellcheck disable=SC2034
 _build_json_cpu() {
-    local cpuid_hex codename caps arch_sub arch_type sbpb_norm
+    local cpuid_hex codename caps arch_sub arch_type
     if [ -n "${cpu_cpuid:-}" ]; then
         cpuid_hex=$(printf '0x%08x' "$cpu_cpuid")
     else
@@ -2526,15 +2524,6 @@ _build_json_cpu() {
         codename=$(get_intel_codename 2>/dev/null || true)
     fi
 
-    # cap_sbpb uses non-standard encoding (1=YES, 2=NO, 3=UNKNOWN) because the
-    # CVE-2023-20569 check distinguishes the unknown case. Normalize for JSON.
-    case "${cap_sbpb:-}" in
-        1) sbpb_norm=1 ;;
-        2) sbpb_norm=0 ;;
-        3) sbpb_norm=-1 ;;
-        *) sbpb_norm='' ;;
-    esac
-
     # Determine architecture type and build the arch-specific sub-object
     case "${cpu_vendor:-}" in
         GenuineIntel | AuthenticAMD | HygonGenuine)
@@ -2588,7 +2577,7 @@ _build_json_cpu() {
                 "$(_json_cap "${cap_tsa_l1_no:-}")" \
                 "$(_json_cap "${cap_verw_clear:-}")" \
                 "$(_json_cap "${cap_autoibrs:-}")" \
-                "$(_json_cap "$sbpb_norm")" \
+                "$(_json_cap "${cap_sbpb:-}")" \
                 "$(_json_cap "${cap_avx2:-}")" \
                 "$(_json_cap "${cap_avx512:-}")")
             arch_sub=$(printf '{"family":%s,"model":%s,"stepping":%s,"cpuid":%s,"platform_id":%s,"hybrid":%s,"codename":%s,"capabilities":%s}' \