Ubuntu To Disable Intel GPU Security Mitigations To Improve Graphics Performance By Up To 20%

The security mitigations deployed for Intel Graphics supposedly hamper the graphics performance, which is now in the talks for removal on Ubuntu.

Canonical and Intel are Reportedly Disabling GPU Security Mitigations, Which Will Improve Intel Graphics Performance by up to 20%

With security flaws such as Spectre and Meltdown, which were witnessed a few years ago, Intel started deploying multiple mitigations for its CPUs, which could cause users’ data to be stolen. Intel released several microcode updates to stop the attacks, but it was mostly for CPUs. However, to be on the safe side, the Intel graphics stack also received several such protections.

Up until now, there have been no reports of such attacks on Intel iGPUs, but due to the mitigation measures, the iGPUs had a downgrade in performance, as found by Canonical, the developer of the Ubuntu operating system. As reported by Phoronix, both Intel and Canonical are working together to remove these security mitigations, as these aren’t crucial for the Intel graphics stack, and removing them will lead to 20% higher performance.

This bug was reported on Launchpad, which states that Ubuntu users can see a 20% performance improvement, but this is likely to get implemented in version 25.10. To disable these mitigations in Ubuntu’s future packages, it will be done through the NEO_DISABLE_MITIGATIONS build. As Intel already ships its official builds of the Intel Compute Runtime from GitHub with these mitigations disabled, it is safe to assume that disabling these on Ubuntu should pose no problem.

After discussion between Intel and Canonical’s security teams, we are in agreement that Spectre no longer needs to be mitigated for the GPU at the Compute Runtime level. At this point, Spectre has been mitigated in the kernel, and a clear warning from the Compute Runtime build serves as a notification for those running modified kernels without those patches. For these reasons, we feel that Spectre mitigations in Compute Runtime no longer offer enough security impact to justify the current performance tradeoff.

However, with such updates, there is still a possibility that this might open an “unknown” avenue for hackers to attack the systems. In order to instill confidence in users, Intel and Canonical have signed off on this change, which means they have formally reviewed and approved the changes they will be implementing in the near future. So, basically, Intel and Canonical are giving the green light to users and developers to use Ubuntu OS without these security mitigations.