CVE-2026-98465

Received Received - Intake

Race Condition in Linux Kernel KVM RISC-V IMSIC Handling

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Serialize IMSIC attributes with vCPU migration KVM device ioctls are not serialized against KVM_RUN. As a result, kvm_riscv_aia_imsic_rw_attr() can snapshot the physical CPU and HGEI of an IMSIC VS-file before a concurrent vCPU migration releases it. The HGEI can then be allocated to another vCPU before imsic_vsfile_rw() uses the stale tuple. A GET or SET attribute may consequently access the new owner's interrupt file. Serialize the entire IMSIC attribute operation with the target vCPU mutex. This prevents the VS-file from being migrated and recycled until the attribute access completes. Acquire the mutex killably so that the device ioctl remains interruptible while waiting for KVM_RUN to finish.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98465

EUVD

EUVD-2026-103705

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	db8b7e97d6137a28b2bfc07e591d54da268f0c36
Linux	Linux	db8b7e97d6137a28b2bfc07e591d54da268f0c36
Linux	Linux	db8b7e97d6137a28b2bfc07e591d54da268f0c36
Linux	Linux	db8b7e97d6137a28b2bfc07e591d54da268f0c36
Linux	Linux	6.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of IMSIC attributes during vCPU migration in KVM. KVM device ioctls are not properly synchronized with KVM_RUN, allowing a race condition where the HGEI (Hypervisor Guest External Interrupt) can be allocated to a new vCPU before the old one finishes using it. This leads to potential access of another vCPU's interrupt file by mistake.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM implementation on RISC-V systems. Detection requires checking kernel logs for KVM-related errors or examining the kernel version for the affected code. Commands like dmesg | grep -i kvm or uname -a may help identify vulnerable systems.

Impact Analysis

This vulnerability could allow an attacker with access to KVM device ioctls to read or modify interrupt files belonging to other virtual machines. This may result in unauthorized access to sensitive data, privilege escalation, or denial of service within the affected system.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the issue. If immediate patching is not possible, restrict access to KVM functionality or disable KVM modules until updates are applied.

Hi! I’m here to help you understand CVE-2026-98465. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70