CVE-2026-64229 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems, especially those using AMD CPUs that support INVLPGB, should be aware of this issue and take necessary actions to protect their systems. This includes inventorying and verifying Linux kernel versions, applying patches, and monitoring system logs for potential exploitation attempts. System administrators and security teams should review system configurations to ensure 'nopcid' is not used unnecessarily and consider disabling PCID if not required. Vulnerability management and security teams should prioritize patching and compensating controls for exposed systems while remediation is scheduled and verified. Monitoring, detection, and logs for exposed assets should be reviewed for extra review. Exceptions, retesting of remediated assets, and closing the item only after evidence is documented are crucial steps in the remediation process. Asset inventory and source tracking are essential for ensuring that all affected systems are accounted for and remediated. Rollback/change windows should be planned and executed carefully to minimize downtime and operational impact. Compensating controls, such as additional monitoring or security measures, should be implemented for systems that cannot be patched immediately. The goal is to minimize the risk of exploitation and ensure the security of Linux-based systems. By taking these steps, organizations can reduce the risk associated with this vulnerability and protect their systems from potential attacks. It is essential to prioritize patching and implement compensating controls to minimize the risk of exploitation. Linux kernel developers and maintainers should prioritize resolving this issue and providing patches for affected systems. Linux distribution vendors should provide updated packages and guidance for their users. Users of Linux-based systems should apply patches and follow recommended actions to protect their systems. By working together, the Linux community can minimize the risk associated with this vulnerability and ensure the security of Linux-based systems. This vulnerability highlights the importance of keeping a

Technical summary

The Linux kernel vulnerability CVE-2026-64229 is related to the handling of broadcast TLB flush when PCID is disabled. The vulnerability can lead to a general protection fault and has been resolved by making X86_FEATURE_INVLPGB dependent on X86_FEATURE_PCID. This change ensures that broadcast TLB support is disabled when PCID is not available. The issue arises when booting with 'nopcid', which clears X86_FEATURE_PCID and keeps CR4.PCIDE from being set to one. On AMD CPUs that support INVLPGB, broadcast TLB flushing remains enabled, potentially leading to a general protection fault when issuing an INVLPGB with a non-zero PCID while CR4.PCIDE is not set. Linux kernel developers, maintainers, and users should be aware of this issue and take necessary actions to protect their systems, including inventorying and verifying Linux kernel versions, applying patches, and monitoring system logs for potential exploitation attempts.

Defensive priority

This vulnerability has a CVSS score of 5.5 and is classified as MEDIUM severity. It is related to the Linux kernel and has been resolved by disabling broadcast TLB flush when PCID is disabled.

Recommended defensive actions

• Inventory and verify Linux kernel versions to identify potentially affected systems.
• Apply patches from Linux kernel stable branches to address the vulnerability.
• Monitor system logs for potential exploitation attempts.
• Consider disabling PCID if not required.
• Review system configurations to ensure 'nopcid' is not used unnecessarily.

Evidence notes

The vulnerability is caused by booting with 'nopcid' which clears X86_FEATURE_PCID and keeps CR4.PCIDE from being set to one. On AMD CPUs that support INVLPGB, broadcast TLB flushing remains enabled. This can lead to a general protection fault when issuing an INVLPGB with a non-zero PCID while CR4.PCIDE is not set. Evidence is limited to public CVE and NVD information.

Official resources