Race condition in Linux kernel - CVE-2026-98639

Vulnerability identifier: #VU156951

CSH Severity: Low

CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-98639

CWE-ID: CWE-362

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause incorrect TLB invalidation, potentially permitting unauthorized memory access through stale address translations.

The vulnerability exists due to a race condition in __kvm_riscv_nacl_hfence() in the Linux kernel's RISC-V KVM implementation when publishing nested HFENCE entries in shared memory. A local user can potentially exploit the visibility of an entry's pending flag before its page number and page count are updated to cause the SBI implementation or NACL hardware to use values from a previous entry, producing incorrect TLB flush ranges.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

• https://git.kernel.org/stable/c/6da466502621381fa88a6684290923d25c559266
• https://git.kernel.org/stable/c/b3d346838ec65fac7fd83f5dbcedd13cadfffddb
• https://git.kernel.org/stable/c/d6de766d8d26d71b714f548192099112def50a9c

• Race condition in Linux kernel riscv kvm
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more