This defect in the Linux kernel causes a general protection fault when a broadcast TLB flush (INVLPGB) is executed with a non‑zero PCID while the CR4.PCIDE bit is clear. The resulting NULL pointer dereference brings down the kernel, which is effectively a denial of service condition for any processes on the affected system. The flaw arises from an incorrect dependency between PCID and broadcast TLB support; the kernel mistakenly assumes PCID is enabled whenever INVLPGB is present, allowing privileged code to trigger a crash.

Linux kernel builds that include the x86/mm code path for global ASID handling and that support broadcast TLB invalidation on AMD CPUs. The vulnerability is triggered specifically under the "nopcid" boot option which disables PCID support, a scenario relevant to any Linux installation that uses that kernel parameter. No specific kernel version range is listed in the data, so any release that incorporates the described code prior to the patch is potentially affected.

The CVSS score is 5.5, and the EPSS figure of < 1% indicates a very low likelihood of exploitation. The vulnerability is not present in CISA’s KEV catalog, suggesting it has not been observed in widespread attacks. Exploitation, however, could be achieved by any code running with kernel privileges that issues an INVLPGB with a non‑zero PCID during a context where CR4.PCIDE is clear. Because the attack requires privileged code and precise CPU feature manipulation, it is unlikely to be abused in the wild, but a kernel crash remains a severe outcome for availability.