Linux Kernel EUVD-2026-48637

Three simultaneous non-default conditions are required: (1) the system must be booted with the 'nopcid' kernel command-line parameter - this is a non-default, explicitly administrator-set boot option that clears X86_FEATURE_PCID and prevents CR4.PCIDE from being set; (2) the CPU must be an AMD processor with INVLPGB broadcast TLB invalidation support (X86_FEATURE_INVLPGB), which is a hardware capability present on newer AMD Zen-generation CPUs; (3) a process's mm_struct must become active on more than three CPUs concurrently, triggering the consider_global_asid() path that assigns a global ASID. Limiting factors: 'nopcid' is almost never used in production - it is a debugging or compatibility workaround parameter; AMD INVLPGB support is hardware-specific; and the multi-CPU mm activation pattern requires genuine parallelism. A low-privilege local account is sufficient to trigger the crash once all three environmental conditions are met, but the attacker cannot create those conditions themselves without pre-existing administrative control over the boot configuration.

CVSS 5.5 Medium (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) correctly identifies this as a local, low-privilege denial-of-service with no confidentiality or integrity impact. However, AC:L may overstate exploitability: the 'nopcid' boot parameter is non-default and administratively controlled, and the AMD INVLPGB hardware capability is required - two conditions beyond a typical low-privilege attacker's control. EPSS of 0.17% at the 6th percentile strongly corroborates low real-world exploitation likelihood. The vulnerability is not in CISA KEV and no POC has been identified. SSVC signals: exploitation status 'none', automatable 'no' (requires specific hardware and boot config), technical impact 'partial' (kernel crash only). The gap between the formal CVSS score and actual risk is notable: this is a low-priority issue in all but the narrow scenario of AMD INVLPGB systems deliberately booted with 'nopcid'. Defenders should prioritize patching primarily in environments using this boot parameter, such as debugging setups or systems with explicit PCID workarounds.

A low-privilege local user on a multi-socket or many-core AMD server (with INVLPGB support) that was booted with 'nopcid' launches a multi-threaded workload - such as a parallel build, database server, or container runtime - causing a process's mm_struct to become active across more than three CPUs simultaneously. The kernel's consider_global_asid() function assigns a global ASID to the mm, and the subsequent flush_tlb_mm_range() call issues INVLPGB with a non-zero PCID while CR4.PCIDE is clear, triggering a #GP that panics the kernel and denies service to all users on the host. No public exploit code has been identified; the crash is reproducible through ordinary high-parallelism workloads on affected configurations.