Linux 6.6.149 ships broken Safe-RET security backport
A config rename left the CVE-2026-68480 fix inert on the long-term 6.6 series until corrected patches land.
Greg Kroah-Hartman has released Linux 6.6.149, urging all users of the 6.6 stable series to upgrade. The drop includes a backport meant to harden the x86 Safe-RET mitigation against interrupt injection, addressing CVE-2026-68480.
That fix does not actually take effect on 6.6. Salvatore Bonaccorso reported that the backported change depends on CONFIG_MITIGATION_SRSO, a Kconfig symbol that only appeared when the older CONFIG_CPU_SRSO name was renamed in the 6.9 development cycle. On 6.6 kernels the new symbol is absent, so the mitigation logic never builds in as intended.
Borislav Petkov, who authored the upstream Safe-RET robustness work, acknowledged the mistake and said corrected backports were already on their way to Kroah-Hartman. Until a follow-up stable update lands, 6.6.149 does not deliver the CVE-2026-68480 protection its changelog implies. Operators who track 6.6 for long-term support should plan on the next point release rather than treating 6.6.149 as complete for this issue.