PT-2026-64344 · Linux · Linux
CVE-2026-64229
·
Published
2026-07-24
·
Updated
2026-07-24
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
x86/mm: Disable broadcast TLB flush when PCID is disabled
Booting with "nopcid" clears X86 FEATURE PCID and keeps CR4.PCIDE from being
set to one. On AMD CPUs that support INVLPGB, broadcast TLB flushing remains
enabled.
There are two checks that decide whether the global ASID code runs,
mm global asid() and consider global asid(), that key off of the
X86 FEATURE INVLPGB feature. Once an mm becomes active on more than three
CPUs, consider global asid() assigns it a global ASID, after which
flush tlb mm range() takes the broadcast tlb flush() path using a non-zero
PCID. Issuing an INVLPGB with a non-zero PCID while CR4.PCIDE is not set
results in a #GP:
Oops: general protection fault, kernel NULL pointer dereference 0x1: 0000 [#1] SMP NOPTI
CPU: 158 UID: 0 PID: 3119 Comm: snap Not tainted 7.1.0-rc3 #1 PREEMPT(full)
Hardware name: ...
RIP: 0010:broadcast tlb flush
Code: ... 89 da 48 83 c8 07 <0f> 01 fe eb 08 cc cc cc ...
Call Trace:
flush tlb mm range
ptep clear flush
wp page copy
? raw spin unlock
handle mm fault
handle mm fault
do user addr fault
exc page fault
asm exc page fault
All processors that support broadcast TLB invalidation also have PCID support,
so it is only the "nopcid" scenario that is of concern. In this situation just
disable the broadcast TLB support using the CPUID dependency support by making
X86 FEATURE INVLPGB dependent on X86 FEATURE PCID.
[ bp: Massage commit message. ]
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux