Race condition in Linux kernel - CVE-2026-98465

Vulnerability identifier: #VU156763

CSH Severity: Low

CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98465

CWE-ID: CWE-362

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to read or modify another vCPU's interrupt file without authorization.

The vulnerability exists due to a race condition in the RISC-V KVM IMSIC attribute handling code when device ioctl operations run concurrently with vCPU migration. A local user can race a GET or SET attribute operation against migration to access another vCPU's interrupt file through stale physical CPU and HGEI values.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/6c2bcf6b173d4afed883cceea9d47f2c5194161d
• https://git.kernel.org/stable/c/71acbea44e78665ea90e3c310fca6bbdcc0252db
• https://git.kernel.org/stable/c/8ae12ccaec6ec74945d8c1ef39f2c1b8df779abc
• https://git.kernel.org/stable/c/a29c5d2dd2ef9a8617a9a6d5585696d5f149cd98
• https://git.kernel.org/stable/c/c525772c304c971b0d3a1f2898dedbae653efe90

• Race condition in Linux kernel riscv kvm
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more