CVE-2026-99099

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99099", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.391Z", "datePublished": "2026-10-26T14:52:04.997Z", "dateUpdated": "2026-10-31T12:42:48.094Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-31T12:42:48.094Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/CPU/AMD: Fix AMD TLBI Erratum #1718\n\nThe processor may fail to invalidate a TLB entry while executing an\nINVLPGB/TLBSYNC instruction pair.\n\nDetect the erratum and apply a software workaround when a microcode fix\nis not present."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - SYSCALL_DEFINE2(munmap)\u2192__vm_munmap\u2192do_vmi_munmap\u2192do_vmi_align_munmap\u2192vms_complete_munmap_vmas\u2192vms_clear_ptes\u2192unmap_region, which runs unmap_vmas then tlb_finish_mmu\u2192tlb_flush_mmu\u2192tlb_flush\u2192flush_tlb_mm_range\u2192broadcast_tlb_flush\u2192patched __tlbsync; no wire protocol carries the trigger.\nAC:L - An attacker can keep one mm active on four CPUs and repeat munmap until consider_global_asid() assigns a broadcast ASID, prime the target TLB entry, and repeatedly exercise the faulty pair while grooming reuse. CONFIG_BROADCAST_TLB_FLUSH is default on AMD64, and all timing/setup is controlled by the attacker's threads.\nPR:L - SYSCALL_DEFINE2(munmap) reaches the path for ordinary anonymous mappings; do_vmi_munmap() only validates the range, and __vm_munmap() only locks current->mm. No capability, authentication, device permission, or privileged namespace operation is required.\nUI:N - The attacker's own threads create and touch a mapping, call munmap(), and access the stale virtual address after reuse. No victim must mount media, open a file, or perform another action.\nS:U - The failed __tlbsync() leaves a stale host CPU translation and compromises pages managed by the same host kernel. This is ordinary local kernel compromise, not a guest-to-host escape or an IOMMU-boundary bypass.\nC:H - zap_present_folio_ptes() clears the PTE and queues its folio, but tlb_finish_mmu() trusts the faulty __tlbsync() before tlb_batch_pages_flush() recycles it through free_pages_and_swap_cache(). The cached user translation can then read the recycled page, including kernel or other-process data.\nI:H - The same stale writable translation bypasses the cleared page table after free_pages_and_swap_cache() recycles the folio. Grooming that page into kernel objects or page tables provides a kernel-memory write primitive capable of control-flow hijacking.\nA:H - Writes through the stale translation can corrupt a recycled page table or kernel object and cause an oops, panic, or hang. The earlier tlbi=ipi mitigation commit also identifies this INVLPGB/TLBSYNC defect as a cause of observed userspace crashes."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/include/asm/cpufeatures.h", "arch/x86/include/asm/tlb.h", "arch/x86/kernel/cpu/amd.c"], "versions": [{"version": "82378c6c2f435dba66145609de16bf44a9de6303", "lessThan": "e3e6779f77ab6f0a1aa80e24868d2d89f31053fe", "status": "affected", "versionType": "git"}, {"version": "82378c6c2f435dba66145609de16bf44a9de6303", "lessThan": "098d80b04d0fe02889c332d061db968f070b83a6", "status": "affected", "versionType": "git"}, {"version": "82378c6c2f435dba66145609de16bf44a9de6303", "lessThan": "87db7795cbaaf636ae22ae031f4906db7bb77803", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/include/asm/cpufeatures.h", "arch/x86/include/asm/tlb.h", "arch/x86/kernel/cpu/amd.c"], "versions": [{"version": "6.15", "status": "affected"}, {"version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e3e6779f77ab6f0a1aa80e24868d2d89f31053fe"}, {"url": "https://git.kernel.org/stable/c/098d80b04d0fe02889c332d061db968f070b83a6"}, {"url": "https://git.kernel.org/stable/c/87db7795cbaaf636ae22ae031f4906db7bb77803"}], "title": "x86/CPU/AMD: Fix AMD TLBI Erratum #1718", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/x86/include/asm/cpufeatures.h", "arch/x86/include/asm/tlb.h", "arch/x86/kernel/cpu/amd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e3e6779f77ab6f0a1aa80e24868d2d89f31053fe", "status": "affected", "version": "82378c6c2f435dba66145609de16bf44a9de6303", "versionType": "git"}, {"lessThan": "098d80b04d0fe02889c332d061db968f070b83a6", "status": "affected", "version": "82378c6c2f435dba66145609de16bf44a9de6303", "versionType": "git"}, {"lessThan": "87db7795cbaaf636ae22ae031f4906db7bb77803", "status": "affected", "version": "82378c6c2f435dba66145609de16bf44a9de6303", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/x86/include/asm/cpufeatures.h", "arch/x86/include/asm/tlb.h", "arch/x86/kernel/cpu/amd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"lessThan": "6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/CPU/AMD: Fix AMD TLBI Erratum #1718\n\nThe processor may fail to invalidate a TLB entry while executing an\nINVLPGB/TLBSYNC instruction pair.\n\nDetect the erratum and apply a software workaround when a microcode fix\nis not present."}], "id": "CVE-2026-99099", "lastModified": "2026-10-31T13:17:55.420", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-26T15:16:48.990", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/098d80b04d0fe02889c332d061db968f070b83a6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/87db7795cbaaf636ae22ae031f4906db7bb77803"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e3e6779f77ab6f0a1aa80e24868d2d89f31053fe"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: x86/CPU/AMD: Fix AMD TLBI Erratum #1718", "id": "2560850", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560850"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-440", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nx86/CPU/AMD: Fix AMD TLBI Erratum #1718\nThe processor may fail to invalidate a TLB entry while executing an\nINVLPGB/TLBSYNC instruction pair.\nDetect the erratum and apply a software workaround when a microcode fix\nis not present.", "A flaw was found in the Linux kernel. On systems running affected AMD processors without microcode fixes, the processor may fail to properly clear cached entries in the Translation Lookaside Buffer (TLB), a hardware cache used to speed up memory address translation, during flush operations. A local user could exploit this condition to cause stale address mappings to persist, potentially leading to memory corruption, denial of service, or unauthorized information disclosure."], "name": "CVE-2026-99099", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99099\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99099\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99099.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[82378c6c2f435dba66145609de16bf44a9de6303,e3e6779f77ab6f0a1aa80e24868d2d89f31053fe)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[82378c6c2f435dba66145609de16bf44a9de6303,098d80b04d0fe02889c332d061db968f070b83a6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[82378c6c2f435dba66145609de16bf44a9de6303,87db7795cbaaf636ae22ae031f4906db7bb77803)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[82378c6c2f435dba66145609de16bf44a9de6303,e3e6779f77ab6f0a1aa80e24868d2d89f31053fe)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[82378c6c2f435dba66145609de16bf44a9de6303,098d80b04d0fe02889c332d061db968f070b83a6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[82378c6c2f435dba66145609de16bf44a9de6303,87db7795cbaaf636ae22ae031f4906db7bb77803)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-26T16:45:14.917486+00:00", "updated": "2026-10-31T14:30:13.416469+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}