CVE-2026-99099: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-99099 is a Linux kernel vulnerability affecting AMD processors, specifically related to AMD TLBI (TLB Invalidation) Erratum #1718. The flaw causes the processor to potentially fail to invalidate a TLB (Translation Lookaside Buffer) entry while executing an INVLPGB/TLBSYNC instruction pair, which can result in stale TLB entries persisting in the cache. It affects the Linux kernel on AMD-based systems, with patches available for versions up to 6.18.57, 7.2.11, and 7.3. The vulnerability was published on October 26, 2026, with an estimated CVSS severity of Medium and a reported EPSS score of 0.0 (Github Advisory, Feedly).

The root cause is a hardware erratum in AMD processors where the INVLPGB (Invalidate TLB entries by ASID and VA, broadcast) and TLBSYNC instruction pair may not correctly complete TLB invalidation across all processor contexts. This is a processor-level bug (hardware erratum) rather than a software coding error, and no specific CWE classification has been assigned. The Linux kernel fix detects the presence of AMD TLBI Erratum #1718 and applies a software workaround when an updated microcode fix is not present on the system. Exploitation requires local access to an affected AMD system, as an attacker would need to execute code in a context where stale TLB entries could be leveraged to access memory belonging to other processes or the kernel (Github Advisory, Feedly).

A local user on an affected AMD system could potentially read or modify memory belonging to other processes or the kernel by exploiting the failure of TLB invalidation, effectively bypassing memory isolation protections. This could lead to unauthorized disclosure of sensitive data (confidentiality impact) or unauthorized modification of memory (integrity impact). The vulnerability is limited to local exploitation and does not directly enable remote code execution, but successful exploitation could facilitate privilege escalation or lateral movement within a compromised host (Feedly, Github Advisory).

There is no public proof-of-concept exploit available for CVE-2026-99099, and no evidence of in-the-wild exploitation has been observed. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to an affected AMD system, which significantly limits the attack surface (Feedly, Github Advisory).

Apply the Linux kernel patches that detect and implement the software workaround for AMD TLBI Erratum #1718; patched versions include Linux kernel 6.18.57, 7.2.11, and 7.3 (Github Advisory). The relevant upstream kernel commits are available at e3e6779f77ab, 098d80b04d0f, and 87db7795cbaa on kernel.org. Additionally, applying AMD microcode updates from your system vendor, if available, may resolve the underlying hardware erratum without requiring the software workaround. Organizations running AMD-based Linux systems should prioritize kernel updates, particularly in multi-tenant or high-security environments where memory isolation is critical (Feedly).