CVE-2026-64229
Received Received - Intake

TLB Flush Issue in Linux Kernel with PCID Disabled

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: x86/mm: Disable broadcast TLB flush when PCID is disabled Booting with "nopcid" clears X86_FEATURE_PCID and keeps CR4.PCIDE from being set to one. On AMD CPUs that support INVLPGB, broadcast TLB flushing remains enabled. There are two checks that decide whether the global ASID code runs, mm_global_asid() and consider_global_asid(), that key off of the X86_FEATURE_INVLPGB feature. Once an mm becomes active on more than three CPUs, consider_global_asid() assigns it a global ASID, after which flush_tlb_mm_range() takes the broadcast_tlb_flush() path using a non-zero PCID. Issuing an INVLPGB with a non-zero PCID while CR4.PCIDE is not set results in a #GP: Oops: general protection fault, kernel NULL pointer dereference 0x1: 0000 [#1] SMP NOPTI CPU: 158 UID: 0 PID: 3119 Comm: snap Not tainted 7.1.0-rc3 #1 PREEMPT(full) Hardware name: ... RIP: 0010:broadcast_tlb_flush Code: ... 89 da 48 83 c8 07 <0f> 01 fe eb 08 cc cc cc ... Call Trace: <TASK> flush_tlb_mm_range ptep_clear_flush wp_page_copy ? _raw_spin_unlock __handle_mm_fault handle_mm_fault do_user_addr_fault exc_page_fault asm_exc_page_fault All processors that support broadcast TLB invalidation also have PCID support, so it is only the "nopcid" scenario that is of concern. In this situation just disable the broadcast TLB support using the CPUID dependency support by making X86_FEATURE_INVLPGB dependent on X86_FEATURE_PCID. [ bp: Massage commit message. ]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-64229
EUVD
EUVD-2026-48637

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel 7.1.0-rc3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel occurs when booting with 'nopcid' disables PCID support but leaves broadcast TLB flushing enabled on AMD CPUs. This can lead to a general protection fault when the kernel attempts to flush TLB entries with a non-zero PCID while CR4.PCIDE is not set, causing a kernel crash.

Detection Guidance

This vulnerability is specific to the Linux kernel and requires checking kernel boot parameters and CPU features. On a Linux system, you can detect it by verifying if the 'nopcid' parameter is used during boot and if your AMD CPU supports INVLPGB but lacks PCID support. Check boot parameters with 'cat /proc/cmdline' and CPU features with 'grep pcid /proc/cpuinfo' and 'grep invlpb /proc/cpuinfo'.

Impact Analysis

This vulnerability can cause system crashes or instability when running on AMD CPUs with the 'nopcid' boot option. It may lead to kernel panics, data corruption, or denial of service if exploited or triggered under specific conditions.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue causing system crashes under specific conditions (nopcid boot option on AMD CPUs). No data exposure or privacy impact is described.

Mitigation Strategies

Remove the 'nopcid' boot parameter if present to enable PCID support. Ensure your kernel is updated to a patched version that disables broadcast TLB flushing when PCID is disabled. Monitor kernel logs for TLB-related errors after changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64229. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart