CVE-2026-64229: Linux Kernel Privilege Escalation Bug

CVE-2026-64229 Overview

CVE-2026-64229 is a Linux kernel vulnerability in the x86 memory management subsystem. The issue occurs when the kernel is booted with the nopcid parameter on AMD CPUs that support INVLPGB broadcast TLB invalidation. The kernel clears X86_FEATURE_PCID and leaves CR4.PCIDE unset, yet broadcast TLB flushing remains enabled. Once a memory descriptor becomes active on more than three CPUs, the global ASID path issues an INVLPGB with a non-zero PCID, which triggers a general protection fault. The result is a kernel oops during routine memory management operations such as copy-on-write page faults.

Critical Impact
A general protection fault in broadcast_tlb_flush() crashes kernel tasks during page fault handling, producing denial-of-service conditions on affected AMD systems booted with nopcid.

Affected Products

Linux kernel builds containing the INVLPGB broadcast TLB flush code path on x86_64
Systems running on AMD CPUs that expose the X86_FEATURE_INVLPGB capability
Kernels booted with the nopcid command line parameter

Discovery Timeline

2026-07-24 - CVE-2026-64229 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64229

Vulnerability Analysis

The vulnerability resides in the x86 memory management TLB flush logic. Booting with nopcid clears X86_FEATURE_PCID and prevents CR4.PCIDE from being set. On AMD processors that support INVLPGB, broadcast TLB flushing continues to run independently of PCID state. The functions mm_global_asid() and consider_global_asid() gate global ASID assignment on X86_FEATURE_INVLPGB alone. When an mm structure becomes active on more than three CPUs, consider_global_asid() assigns it a global ASID. Subsequent calls to flush_tlb_mm_range() take the broadcast_tlb_flush() path with a non-zero PCID. Issuing an INVLPGB instruction with a non-zero PCID while CR4.PCIDE is disabled generates a #GP fault, crashing the calling task within exc_page_fault handling.

Root Cause

The root cause is a missing feature dependency between X86_FEATURE_INVLPGB and X86_FEATURE_PCID. The global ASID selection code assumed PCID would always be available on processors advertising INVLPGB. The nopcid boot parameter invalidated that assumption without disabling the broadcast TLB path. This is a kernel-level configuration and feature-gating flaw [CWE-670: Always-Incorrect Control Flow Implementation].

Attack Vector

The defect is not remotely exploitable. It manifests as a kernel general protection fault triggered by ordinary user-space memory activity, such as a copy-on-write fault through wp_page_copy(), on a system administratively booted with nopcid. A local unprivileged process can reliably trigger the crash on affected AMD hardware once its mm runs on more than three CPUs, resulting in denial of service. The referenced kernel oops shows the fault occurring inside broadcast_tlb_flush during ptep_clear_flush in the page fault path.

No verified exploitation code is available. See the Linux Kernel Patch for the authoritative technical description.

Detection Methods for CVE-2026-64229

Indicators of Compromise

Kernel log entries reporting Oops: general protection fault with RIP: pointing to broadcast_tlb_flush on AMD x86_64 hosts.
Call traces that include flush_tlb_mm_range, ptep_clear_flush, wp_page_copy, __handle_mm_fault, and exc_page_fault.
Presence of nopcid in /proc/cmdline on hosts with CPUs exposing INVLPGB.

Detection Strategies

Inventory Linux hosts and flag any AMD system where /proc/cmdline contains nopcid and /proc/cpuinfo lists invlpgb under CPU flags.
Parse dmesg and journalctl -k output for repeating general protection fault events referencing broadcast_tlb_flush.
Correlate unexpected process terminations with kernel oops entries to identify systems hitting the fault under load.

Monitoring Recommendations

Forward kernel ring buffer and kdump crash reports to a centralized logging platform for correlation.
Alert on any new kernel oops referencing TLB flush symbols across the Linux fleet.
Track kernel version drift so patched builds are propagated consistently to affected AMD hosts.

How to Mitigate CVE-2026-64229

Immediate Actions Required

Remove nopcid from the kernel command line on affected AMD hosts unless it is required for a specific workaround.
Deploy a kernel build that contains the upstream fix making X86_FEATURE_INVLPGB dependent on X86_FEATURE_PCID.
Reboot affected systems after applying the patched kernel to activate the corrected feature dependency.

Patch Information

The upstream fix updates the CPUID feature dependency table so that X86_FEATURE_INVLPGB is disabled whenever X86_FEATURE_PCID is not present. This prevents the global ASID logic from taking the broadcast TLB path on kernels booted with nopcid. Refer to the following commits: Linux Kernel Patch 44126343, Linux Kernel Patch d2d6d212, and Linux Kernel Patch fed725ca.

Workarounds

Boot without the nopcid parameter so CR4.PCIDE is enabled and INVLPGB with a non-zero PCID is legal.
If nopcid is mandatory, disable INVLPGB broadcast TLB flushing via a kernel option or blocklist affected AMD hardware from the workload pool until patched.
Restrict scheduling so sensitive workloads run on fewer than four CPUs, avoiding the global ASID assignment threshold, as a short-term stopgap only.

bash

# Verify vulnerable configuration and remove nopcid from GRUB
grep -o 'nopcid' /proc/cmdline && echo 'nopcid present - vulnerable configuration'
grep -o 'invlpgb' /proc/cpuinfo | head -1

# Edit default GRUB config to remove nopcid, then regenerate
sudo sed -i 's/\bnopcid\b//g' /etc/default/grub
sudo update-grub   # Debian/Ubuntu
# sudo grub2-mkconfig -o /boot/grub2/grub.cfg   # RHEL/Fedora
sudo reboot