CVE-2025-38518

x86/CPU/AMD: Disable INVLPGB on Zen2

published August 16, 2025

CVSS
—
EPSS
0%
Percentile
2.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

x86/CPU/AMD: Disable INVLPGB on Zen2

AMD Cyan Skillfish (Family 17h, Model 47h, Stepping 0h) has an issue

that causes system oopses and panics when performing TLB flush using

INVLPGB.

However, the problem is that that machine has misconfigured CPUID and

should not report the INVLPGB bit in the first place. So zap the

kernel's representation of the flag so that nothing gets confused.

[ bp: Massage. ]

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00130 · 2.4th percentile
Published
2025-08-16T10:55Z
EPSS history
Timeline
  • 16 AUG 10:55Z
    x86/CPU/AMD: Disable INVLPGB on Zen2
    cvelistv5