Re: PROBLEM: Probabilistic segfault on AMD hardware with INVLPGB

From: Tal Zussman

Date: Sun Sep 13 2026 - 22:22:15 EST


On Wed, Jul 08, 2026 at 08:51:46AM -0700, Borislav Petkov wrote:
> Thanks, we're looking into it now. I'll get back to you.

Hi,

I'm running into this issue on a Turin Dense machine:

AMD EPYC 9965 (CPUID 0x00b10f10), 2 sockets, microcode 0x0b101028
AGESA TurinPI-SP5 1.0.0.3
Ubuntu 7.0.0-30 (7.0.12)

I tested Matt's reproducer and it results in corruption in the first round.
With clearcpuid=419, 20 rounds pass. The multithreaded service I'm running
corrupts its heap within seconds of fork() under load. An extra INVLPGB +
TLBSYNC from the forking CPU after each fork() (a one-page mprotect toggle)
makes the issue go away.

Is there any update on either a fix from AMD or merging Rik's double TLBSYNC
workaround?

Thanks,
Tal