SB2026102666 - Protection mechanism failure in Linux kernel kernel cpu

Description

This security bulletin contains information about 1 vulnerability.

1) Protection mechanism failure (CVE-ID: CVE-2026-99099)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially access memory through stale address translations that should have been invalidated.

The vulnerability exists due to incomplete invalidation of translation lookaside buffer entries in the Linux kernel's AMD x86 TLB handling when executing an INVLPGB/TLBSYNC instruction pair. A local user can potentially exploit retained address translations to access memory using mappings that should no longer be valid.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/098d80b04d0fe02889c332d061db968f070b83a6
• https://git.kernel.org/stable/c/87db7795cbaaf636ae22ae031f4906db7bb77803
• https://git.kernel.org/stable/c/e3e6779f77ab6f0a1aa80e24868d2d89f31053fe