Docs

Elastic Compute Service

Linux operating system issue

Performance degradation after the operating system of an ECS instance configured with Intel CPU is updated to a Linux public image

Cause

To avoid potential security issues caused by the Spectre Variant 2 and Spectre Variant 4 (Speculative Store Bypass) vulnerabilities, some Linux public images provided by Volcano Engine have the CPU vulnerability fixing feature enabled by default. When you use an image with this feature enabled, it may result in performance degradation of the instance.

Solution

When using Ubuntu, Debian, veLinux, CentOS, RHEL, veLinux CentOS Compatible, or Fedora images, you can refer to the guide to enable or disable the CPU vulnerability fixing feature based on your needs.

Execute the following command to query the current boot mode of the operating system.

if [ -d /sys/firmware/efi ]; then
echo "UEFI"
else
echo "BIOS"
fi

Execute the following commands to enable or disable the CPU vulnerability fixing feature.

Enable

sed -i "s/ nospectre_v2 nospec_store_bypass_disable//g" /etc/default/grub

Disable

sed -i "/GRUB_CMDLINE_LINUX=\"/s/\"$/ nospectre_v2 nospec_store_bypass_disable\"/" /etc/default/grub

Execute the following command to regenerate the grub file.

Ubuntu/Debian/veLinux
CentOS/RHEL/veLinux CentOS Compatible
Fedora

update-grub
UEFI boot mode

grub2-mkconfig -o /boot/efi/EFI/centos/grub.cfg

BIOS boot mode

grub2-mkconfig -o /boot/grub2/grub.cfg
UEFI boot mode

grub2-mkconfig -o /boot/efi/EFI/fedora/grub.cfg

BIOS boot mode

grub2-mkconfig -o /boot/grub2/grub.cfg

Execute the following command to restart the instance for the configuration to take effect.

reboot

Execute the following command to view the vulnerability status file and check whether the CPU vulnerability fixing feature is enabled.

cd /sys/devices/system/cpu/vulnerabilities/
for i in `ls`;do echo -n $i": ";cat $i;done

If the output information contains spectre_v2: Vulnerable and spec_store_bypass: Vulnerable, it indicates that the feature of fixing Spectre Variant 2 and Spectre Variant 4 vulnerabilities on the current CPU is disabled. Otherwise, it is enabled.

Last updated: 2026.06.18 17:49:52