Linux x86/mm - broadcast TLB flush with PCID disabled: Booting with nopcid clears the PCID feature but broadcast TLB

Impact

Booting with nopcid clears the PCID feature but broadcast TLB flushing stayed enabled, leaving TLB invalidation in an inconsistent configuration. Stale TLB entries are a memory-isolation problem: a translation that should have been invalidated but was not means one address space can still reach a mapping that was revoked.

Who can reach it

Local, on hosts booted with nopcid. Not attacker-selected unless the attacker controls boot parameters - but plenty of fleets set nopcid for debugging or for old mitigation workarounds and forget it.

What to do

Fixed in the Linux kernel. Distro kernel update plus reboot. Also audit your boot parameters: nopcid is a performance and now correctness liability that is often left in place long after the reason for it is gone.

References