Ubuntu to Disable Intel GPU Security Mitigations, Promising Up to 20% Performance Boost
Canonical and Intel Agree to Remove Non-Essential GPU Protections to Enhance Graphics Performance
Performance Over Precaution for Intel iGPUs
In a significant update for Ubuntu users, Canonical and Intel have agreed to disable certain GPU security mitigations for Intel integrated graphics, promising a substantial 20% performance improvement.
- The decision stems from findings that existing security measures, initially deployed to protect against vulnerabilities like Spectre and Meltdown, have unnecessarily hampered Intel iGPU performance.
- While these mitigations were critical for CPUs, no known attacks have targeted Intel’s iGPUs, making the protections increasingly redundant.
Changes Coming in Ubuntu 25.10
According to reports from Phoronix, the performance-enhancing change will be implemented in Ubuntu version 25.10, expected later this year.
- The update will be introduced via the NEO_DISABLE_MITIGATIONS build flag, disabling mitigations at the Compute Runtime level for Intel graphics.
- Notably, Intel already distributes its official Intel Compute Runtime builds from GitHub with these mitigations disabled, suggesting low associated risk.
Security Considerations Addressed
Following discussions between Intel’s and Canonical’s security teams, both parties concluded that:
- Existing kernel-level mitigations sufficiently protect against Spectre vulnerabilities.
- The performance trade-offs of maintaining GPU-level mitigations outweigh the negligible security benefits they now provide.
- A warning system remains in place for users running modified kernels lacking essential patches.
Potential Risks Remain Minimal but Not Eliminated
Though the update is backed by formal approval from both Intel and Canonical, a theoretical risk remains:
- Disabling GPU-level mitigations could open unknown avenues for exploitation, though no such vulnerabilities have been publicly identified.
- By officially signing off on the change, Intel and Canonical aim to reassure developers and users that the move balances security and performance effectively.
With this update, Ubuntu users can expect noticeably improved graphics performance on Intel hardware, while Intel and Canonical continue to monitor the evolving security landscape.
