SB20261022225 - Race condition in Linux kernel riscv kvm

Description

This security bulletin contains information about 1 vulnerability.

1) Race condition (CVE-ID: CVE-2026-98639)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause incorrect TLB invalidation, potentially permitting unauthorized memory access through stale address translations.

The vulnerability exists due to a race condition in __kvm_riscv_nacl_hfence() in the Linux kernel's RISC-V KVM implementation when publishing nested HFENCE entries in shared memory. A local user can potentially exploit the visibility of an entry's pending flag before its page number and page count are updated to cause the SBI implementation or NACL hardware to use values from a previous entry, producing incorrect TLB flush ranges.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/6da466502621381fa88a6684290923d25c559266
• https://git.kernel.org/stable/c/b3d346838ec65fac7fd83f5dbcedd13cadfffddb
• https://git.kernel.org/stable/c/d6de766d8d26d71b714f548192099112def50a9c