“On Linux, IBPB is activated by default during transitions to SECCOMP mode or tasks with restricted indirect branches in the kernel, but its use is limited due to causing a 50% performance hit.”
Three UC San Diego researchers found predictable indexing and tagging in the branch predictors of Intel’s 12th and 13th generation Core chips. That lets an attacker steer speculative execution and break ASLR. Intel has known since February. The main fix costs up to half your performance, which is why Linux only turns it on in narrow cases.