PT-2026-64344 · Linux · Linux

CVE-2026-64229

·

Publicado

2026-07-24

·

Atualizado

2026-07-24

Nenhuma

Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
x86/mm: Disable broadcast TLB flush when PCID is disabled
Booting with "nopcid" clears X86 FEATURE PCID and keeps CR4.PCIDE from being set to one. On AMD CPUs that support INVLPGB, broadcast TLB flushing remains enabled.
There are two checks that decide whether the global ASID code runs, mm global asid() and consider global asid(), that key off of the X86 FEATURE INVLPGB feature. Once an mm becomes active on more than three CPUs, consider global asid() assigns it a global ASID, after which flush tlb mm range() takes the broadcast tlb flush() path using a non-zero PCID. Issuing an INVLPGB with a non-zero PCID while CR4.PCIDE is not set results in a #GP:
Oops: general protection fault, kernel NULL pointer dereference 0x1: 0000 [#1] SMP NOPTI CPU: 158 UID: 0 PID: 3119 Comm: snap Not tainted 7.1.0-rc3 #1 PREEMPT(full) Hardware name: ... RIP: 0010:broadcast tlb flush Code: ... 89 da 48 83 c8 07 <0f> 01 fe eb 08 cc cc cc ... Call Trace: flush tlb mm range ptep clear flush wp page copy ? raw spin unlock handle mm fault handle mm fault do user addr fault exc page fault asm exc page fault
All processors that support broadcast TLB invalidation also have PCID support, so it is only the "nopcid" scenario that is of concern. In this situation just disable the broadcast TLB support using the CPUID dependency support by making X86 FEATURE INVLPGB dependent on X86 FEATURE PCID.
[ bp: Massage commit message. ]
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2026-64229

Produtos afetados

Linux