CVE-2026-98639
Received Received - Intake

KVM riscv NACL hfence entry update order fix

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: KVM: riscv: Fix NACL hfence entry update order The SBI v3.0 specification (section 15.1.2) requires a nested HFENCE entry to be populated as follows: 1) find an unused entry with Config.Pending == 0 2) update the Page_Number and Page_Count words 3) update the Config word with Config.Pending set __kvm_riscv_nacl_hfence() writes the Config word first, so the SBI implementation (or NACL hardware) can observe a pending entry with pnum/pcount values left over from the previous use of that entry, resulting in incorrect TLB flush ranges. Write pnum and pcount first and the Config word last. Since the consumer is an external agent on coherent shared memory, use WRITE_ONCE() to stop the compiler from reordering the stores and smp_wmb() to make the parameter words globally visible before the Pending bit is set.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98639
EUVD
EUVD-2026-103553

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Linux Linux d466c19cead5904d4d5d92adb2b213b411d3b849
Linux Linux d466c19cead5904d4d5d92adb2b213b411d3b849
Linux Linux d466c19cead5904d4d5d92adb2b213b411d3b849
Linux Linux 6.13

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel affects the KVM subsystem for RISC-V architecture. It involves incorrect ordering when updating nested HFENCE entries in the SBI v3.0 specification. The issue occurs because the Config word is written before the Page_Number and Page_Count words, which can lead to the SBI implementation observing stale values, causing incorrect TLB flush ranges.

Detection Guidance

This vulnerability is specific to the Linux kernel's KVM implementation for RISC-V systems. Detection requires checking the kernel version and verifying if the affected code path is present. Use commands like 'uname -a' to check the kernel version and 'grep' to inspect the kernel source for the vulnerable function __kvm_riscv_nacl_hfence().

Impact Analysis

This vulnerability could allow a guest VM to manipulate TLB flush operations, potentially leading to memory corruption or privilege escalation. It may cause system instability, crashes, or unauthorized access to sensitive data depending on the affected system's configuration and usage.

Mitigation Strategies

Apply the latest kernel patch that fixes this issue. Update your Linux kernel to a version that includes the fix for CVE-2026-98639. If a patch is not yet available, consider disabling KVM for RISC-V if not required, or restrict access to virtualization features.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98639. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart