SPECTRE(1)

💅 SPECTRE — the manual page, but make it make sense

okay bestie, you've stumbled into SPECTRE(1), a User Commands situation. Sit down, grab a boba, because we're about to vibe-check your kernel. 🫶

---

✨ NAME ✨

Spectre — the Spectre and Meltdown mitigation detection tool. yes she's that girl. no cap. 👑

---

🌸 DESCRIPTION 🌸

It's the Spectre and Meltdown mitigation detection tool, currently serving v26.36.0913490. iconic. let's get into it. 🎀

🦋 Modes 🦋

💖 Live mode

spectre-meltdown-checker [options] [--kernel <kimage>] [--config <kconfig>] [--map <mapfile>]

She inspects the kernel that's literally running right now, within the context of the CPU it's running on. main character behaviour fr fr.

You can optionally hand her --kernel, --config, or --map to help the script locate files it couldn't auto-detect. she's not psychic, she just cares. 🙈

💜 No-runtime mode

spectre-meltdown-checker [options] --no-runtime <--kernel <kimage>> [--config <kconfig>] [--map <mapfile>]

Inspects the CPU hardware, but skips all running-kernel artifacts (/sys, /proc, dmesg). use this when you've got a kernel image that's different from the kernel you're running, but you still wanna check it against this CPU. it's giving "checking a fit on a different body type". 💅

🧚 No-hardware mode

spectre-meltdown-checker [options] --no-hw <--kernel <kimage>> [--config <kconfig>] [--map <mapfile>]

Ignores both the CPU hardware and the running-kernel artifacts. pure static analysis of a kernel image, bestie. use it when you're inspecting a kernel that's targeted for another system or another CPU. it's giving long-distance relationship. 💔

🌈 Hardware-only mode

spectre-meltdown-checker [options] --hw-only

Only inspects the CPU hardware, and reports information and affectedness per vulnerability. no kernel, no drama, just vibes. ✨

---

🔍 Vulnerability selection 🔍

• --variant VARIANT — specify which variant you'd like to check. by default, all variants are checked. can be used multiple times (e.g. --variant 3a --variant l1tf). for a list, use 'help'. obsessed with the flexibility tbh. 💫
• --cve CVE — specify which CVE you'd like to check. by default, all supported CVEs are checked. can be used multiple times (e.g. --cve CVE-2017-5753 --cve CVE-2020-0543). yes queen, be specific. 👑
• --errata NUMBER — specify a vendor-numbered erratum (e.g. ARM64 erratum 1530923) that has no CVE assigned. maps the erratum to the corresponding check. for a list use 'help'. can be used multiple times (e.g. --errata 1530923 --errata 3194386). the way that some bugs don't even get a CVE name… 😭

---

🎀 Check scope 🎀

• --no-sysfs — don't use the /sys interface even if present [Linux]
• --sysfs-only — only use the /sys interface, don't run our own checks [Linux]

---

😤 Strictness 😤

• --paranoid — require all mitigations to be enabled to the fullest extent, including those that aren't strictly necessary but provide defense in depth (e.g. SMT disabled, IBPB always-on). without this flag, the script follows the security community consensus. she's not like other flags. 🔥
• --extra — run additional checks for issues that don't have a CVE but are still security-relevant, such as compile-time mitigations not enabled by default (e.g. Straight-Line Speculation). lowkey thorough. 💜

---

🖥️ Hardware and platform 🖥️

• --cpu [#,all] — interact with CPUID and MSR of CPU core number #, or all (default: CPU core 0)
• --vmm [auto,yes,no] — override the detection of the presence of a hypervisor, default: auto
• --allow-msr-write — allow probing for write-only MSRs. this might produce kernel logs or be blocked by your system ⚠️ (not a drill, bestie)
• --arch-prefix PREFIX — specify a prefix for cross-inspecting a kernel of a different arch, for example "aarch64-linux-gnu-", so that invoked tools will be prefixed with this (i.e. aarch64-linux-gnu-objdump)
• --coreos — special mode for CoreOS (use an ephemeral toolbox to inspect kernel) [Linux]

---

📤 Output 📤

• --batch FORMAT — produce machine readable output. FORMAT is one of: text (default), short, json, json-terse, nrpe, prometheus. slay, options. 🌟
• --no-color — don't use color codes 🎨
• --verbose, -v — increase verbosity level, possibly several times. (yes, you can stack her. she loves that.) 💬
• --explain — produce an additional human-readable explanation of actions to take to mitigate a vulnerability

---

🗄️ Firmware database 🗄️

• --update-fwdb — update our local copy of the CPU microcodes versions database (using the awesome MCExtractor project and the Intel firmwares GitHub repository). shoutout to the sources, they ate. 🙌
• --update-builtin-fwdb — same as --update-fwdb but update builtin DB inside the script itself

---

🐛 Debug 🐛

• --dump-mock-data — used to mimick a CPU on an other system, mainly used to help debugging this script. (yes, "mimick" is spelled that way in the original, we're keeping it, periodt.) 💀

---

🚦 Return codes 🚦

• 0 — not vulnerable
• 2 — vulnerable
• 3 — unknown
• 255 — error

---

IMPORTANT: A false sense of security is worse than no security at all. Please use the --disclaimer option to understand exactly what this script does. like, actually read it. don't just scroll past. i'm not mad, i'm just disappointed. 😭

---

okay that's the whole page, you're officially caught up bestie 💖

this page came from the Spectre and Meltdown mitigation detection tool source, and it's dated September 2026. go be safe out there, the CPUs are not okay but you are. 🌸🦋✨