News › security
By Zayden R., September 15, 2026
AMD has released patches for Enhanced SMT Protection on Linux, improving security for EPYC VMs using SEV-SNP. Engineers gain hardware-enforced security against side-channel attacks.
AMD engineers have just sent out patches to the Linux kernel mailing list, aiming to implement Enhanced SMT Protection (ESMTP) for virtual machines running on EPYC server processors with SEV-SNP. This is significant because it introduces a hardware-based security measure designed to mitigate side-channel attacks associated with Simultaneous Multi-Threading (SMT) and Intel's Hyper-Threading technology.
The Enhanced SMT Protection feature is presumably part of the new AMD EPYC 9006, codenamed "Venice," server processors. Unlike existing mechanisms such as core scheduling, which rely on host kernel policies, ESMTP ensures that SMT sibling threads are either idle in host mode or running a vCPU of the guest itself. This hardware-level enforcement is a notable improvement for those concerned with the security risks of sharing core resources with untrusted host threads or other guests.
The kernel patch series describes ESMTP as allowing a Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP) VM to ensure that all SMT sibling threads on a physical core are either idle or running a legal sibling vCPU declared by the guest. This is achieved through a sibling mask that resides in the Virtual Machine State Area (VMSA), ensuring that the host cannot execute arbitrary tasks on sibling threads when a vCPU is active in guest mode.
In addition to the Linux kernel patches, updates are also required for QEMU and OVMF to fully support this feature. The ESMTP functionality is only operational when SEV-SNP is engaged, making it a niche but vital update for systems focused on enhanced virtualization security.
For engineers, this means a more secure environment for running virtual machines on AMD hardware, with less risk of side-channel attacks. It is a thoughtful addition for those leveraging AMD's EPYC processors in data centers or cloud environments.