CVE-2026-99099

What it actually does

Processor fails to invalidate TLB entries during INVLPGB/TLBSYNC instruction pairs on affected AMD CPUs, leaving stale address translations that can cause memory corruption or incorrect data access.

Why it matters to the business

Linux systems running on vulnerable AMD hardware risk unpredictable behavior, crashes, or potential unauthorized memory access, increasing operational instability and exposure in high-throughput environments.

How an attack unfolds

An attacker with local code execution crafts sequences of TLB-modifying operations to trigger the erratum, then leverages retained stale entries to read or corrupt memory that should have been protected.

How to fix it

Apply the kernel patch that detects the erratum and installs a software workaround when microcode mitigation is absent; keep systems on current kernel branches that include this fix.

How to confirm the fix worked

Boot patched kernel on affected AMD hardware and verify erratum detection messages in dmesg; confirm no TLB invalidation failures under synthetic INVLPGB workloads.

Typical attack path

1. Obtain local execution on target AMD Linux system
2. Trigger INVLPGB/TLBSYNC pairs under specific TLB conditions
3. Exploit retained stale translations for memory access violations
4. Escalate to corruption or information disclosure

How to detect it

Review kernel logs for erratum detection strings and TLB invalidation anomalies; no widespread exploitation artifacts are known at this time.

What your security team should do

• Prioritize kernel updates on all AMD-based Linux hosts within the next maintenance window
• Enable microcode updates via firmware packages to reduce reliance on software workarounds
• Monitor for kernel oops or TLB-related warnings in production workloads