Linux Kernel: Incomplete TLB invalidation on AMD Zen CPUs (erratum 1718)
Summary
The Linux x86 kernel code for AMD CPUs can fail to invalidate a TLB entry while the INVLPGB/TLBSYNC instruction pair runs, which is tied to AMD erratum #1718. An attacker with local access and low privileges could potentially read or modify memory they should not reach, which affects confidentiality, integrity and availability. The kernel applies a software workaround when the CPU microcode fix is missing. No exploitation has been reported.
Affected
- Linux kernel versions from commit 82378c6c2f43 until the fix commits. Sources disagree on the exact ranges: OSV lists 6.15.0 and 6.19.0 as introduced, and the CNA record also lists 6.15.
- AMD Zen CPUs with erratum #1718 that run without the microcode fix. Affected CPU models are not clearly listed in public sources.
Fixed in
- Fix commits: e3e6779f77ab, 098d80b04d0f, 87db7795cbaa.
- OSV lists fixed versions 6.18.57 and 7.2.11. Other sources give different version data, so check your distro advisory for the package version.
- AMD microcode update with the erratum 1718 fix.
Workaround
- The kernel workaround applies automatically when the microcode fix is absent. No separate configuration switch was found.
- Unknown.
Exploitation
- No evidence of exploitation in the wild. Not listed in CISA KEV.
- No public proof of concept found.
- An unverified, secondhand claim of a stale translation after virtual address reuse was reported. It has not been confirmed from a primary source.
Our recommendation
- Inventory Linux hosts running on AMD EPYC or Ryzen CPUs, especially multi-tenant, virtualization and shared servers.
- Install the fixed kernel from your distro and update AMD CPU microcode, then reboot.
- Track your distro's security advisories for CVE-2026-99099.
- Priority is routine maintenance, not an emergency, as no exploitation is known and local access is required.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux stable commit 098d80b04d0f git.kernel.org
- Linux stable commit 87db7795cbaa git.kernel.org
- Linux stable commit e3e6779f77ab git.kernel.org
- OSV BELL-CVE-2026-99099 osv.dev
- Ubuntu CVE-2026-99099 ubuntu.com
- Red Hat CVE data access.redhat.com
- Strix CVE-2026-99099 www.strix.ai
- Phoronix: Linux workaround for TLBI erratum 1718 www.phoronix.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:18.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Fix AMD TLBI Erratum #1718 The processor may fail to invalidate a TLB entry while executing an INVLPGB/TLBSYNC instruction pair. Detect the erratum and apply a software workaround when a microcode fix is not present.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.