CVE-2026-98465

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98465", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.350Z", "datePublished": "2026-10-18T15:15:17.498Z", "dateUpdated": "2026-10-24T14:08:57.467Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-24T14:08:57.467Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRISC-V: KVM: Serialize IMSIC attributes with vCPU migration\n\nKVM device ioctls are not serialized against KVM_RUN. As a result,\nkvm_riscv_aia_imsic_rw_attr() can snapshot the physical CPU and HGEI of\nan IMSIC VS-file before a concurrent vCPU migration releases it.\n\nThe HGEI can then be allocated to another vCPU before imsic_vsfile_rw()\nuses the stale tuple. A GET or SET attribute may consequently access the\nnew owner's interrupt file.\n\nSerialize the entire IMSIC attribute operation with the target vCPU\nmutex. This prevents the VS-file from being migrated and recycled until\nthe attribute access completes. Acquire the mutex killably so that the\ndevice ioctl remains interruptible while waiting for KVM_RUN to finish."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H", "baseScore": 7, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - A local process reaches the patched kvm_riscv_aia_imsic_rw_attr() through kvm_device_ioctl() and aia_get_attr()/aia_set_attr() using KVM_GET_DEVICE_ATTR or KVM_SET_DEVICE_ATTR; no network or guest-protocol input reaches it.\nAC:H - The attacker can race its attribute ioctl against KVM_RUN, but cross-owner impact also requires kvm_riscv_aia_alloc_hgei() to reassign the freed per-CPU HGEI to a victim vCPU before imsic_vsfile_rw() runs, which the attacker cannot ensure.\nPR:L - No capable() check guards this path, but the caller must have opened /dev/kvm and created and retained the VM, vCPU, and RISC-V AIA device fds; ordinary authorized KVM-user access suffices without init-namespace administration.\nUI:N - The attacking process itself issues the concurrent KVM_RUN and KVM_GET_DEVICE_ATTR or KVM_SET_DEVICE_ATTR operations; no victim user must mount, open, or approve anything.\nS:C - kvm_riscv_aia_alloc_hgei() uses the global per-CPU aia_hgei owners array rather than a per-VM pool, so the recycled interrupt file can belong to a vCPU in a different VM security boundary.\nC:L - A stale GET makes imsic_vsfile_local_rw() disclose one selected EIDELIVERY, EITHRESHOLD, EIP*, or EIE* word from the new owner's interrupt file, exposing bounded interrupt state rather than arbitrary guest or host memory.\nI:L - A stale SET makes imsic_vsfile_local_rw() write attacker-chosen values to the new owner's delivery, threshold, pending, or enable register, but it provides no arbitrary memory write or demonstrated control-flow primitive.\nA:H - imsic_vsfile_local_rw() can write EIDELIVERY=0 or clear EIE* in the new owner's file; for a single-vCPU victim this suppresses all external-interrupt delivery and can leave guest I/O persistently hung."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/riscv/kvm/aia_imsic.c"], "versions": [{"version": "db8b7e97d6137a28b2bfc07e591d54da268f0c36", "lessThan": "6c2bcf6b173d4afed883cceea9d47f2c5194161d", "status": "affected", "versionType": "git"}, {"version": "db8b7e97d6137a28b2bfc07e591d54da268f0c36", "lessThan": "a29c5d2dd2ef9a8617a9a6d5585696d5f149cd98", "status": "affected", "versionType": "git"}, {"version": "db8b7e97d6137a28b2bfc07e591d54da268f0c36", "lessThan": "c525772c304c971b0d3a1f2898dedbae653efe90", "status": "affected", "versionType": "git"}, {"version": "db8b7e97d6137a28b2bfc07e591d54da268f0c36", "lessThan": "71acbea44e78665ea90e3c310fca6bbdcc0252db", "status": "affected", "versionType": "git"}, {"version": "db8b7e97d6137a28b2bfc07e591d54da268f0c36", "lessThan": "8ae12ccaec6ec74945d8c1ef39f2c1b8df779abc", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/riscv/kvm/aia_imsic.c"], "versions": [{"version": "6.5", "status": "affected"}, {"version": "0", "lessThan": "6.5", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6c2bcf6b173d4afed883cceea9d47f2c5194161d"}, {"url": "https://git.kernel.org/stable/c/a29c5d2dd2ef9a8617a9a6d5585696d5f149cd98"}, {"url": "https://git.kernel.org/stable/c/c525772c304c971b0d3a1f2898dedbae653efe90"}, {"url": "https://git.kernel.org/stable/c/71acbea44e78665ea90e3c310fca6bbdcc0252db"}, {"url": "https://git.kernel.org/stable/c/8ae12ccaec6ec74945d8c1ef39f2c1b8df779abc"}], "title": "RISC-V: KVM: Serialize IMSIC attributes with vCPU migration", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/riscv/kvm/aia_imsic.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6c2bcf6b173d4afed883cceea9d47f2c5194161d", "status": "affected", "version": "db8b7e97d6137a28b2bfc07e591d54da268f0c36", "versionType": "git"}, {"lessThan": "a29c5d2dd2ef9a8617a9a6d5585696d5f149cd98", "status": "affected", "version": "db8b7e97d6137a28b2bfc07e591d54da268f0c36", "versionType": "git"}, {"lessThan": "c525772c304c971b0d3a1f2898dedbae653efe90", "status": "affected", "version": "db8b7e97d6137a28b2bfc07e591d54da268f0c36", "versionType": "git"}, {"lessThan": "71acbea44e78665ea90e3c310fca6bbdcc0252db", "status": "affected", "version": "db8b7e97d6137a28b2bfc07e591d54da268f0c36", "versionType": "git"}, {"lessThan": "8ae12ccaec6ec74945d8c1ef39f2c1b8df779abc", "status": "affected", "version": "db8b7e97d6137a28b2bfc07e591d54da268f0c36", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/riscv/kvm/aia_imsic.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"lessThan": "6.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRISC-V: KVM: Serialize IMSIC attributes with vCPU migration\n\nKVM device ioctls are not serialized against KVM_RUN. As a result,\nkvm_riscv_aia_imsic_rw_attr() can snapshot the physical CPU and HGEI of\nan IMSIC VS-file before a concurrent vCPU migration releases it.\n\nThe HGEI can then be allocated to another vCPU before imsic_vsfile_rw()\nuses the stale tuple. A GET or SET attribute may consequently access the\nnew owner's interrupt file.\n\nSerialize the entire IMSIC attribute operation with the target vCPU\nmutex. This prevents the VS-file from being migrated and recycled until\nthe attribute access completes. Acquire the mutex killably so that the\ndevice ioctl remains interruptible while waiting for KVM_RUN to finish."}], "id": "CVE-2026-98465", "lastModified": "2026-10-24T14:16:43.033", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 1.1, "impactScore": 5.3, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-18T16:16:56.993", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6c2bcf6b173d4afed883cceea9d47f2c5194161d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/71acbea44e78665ea90e3c310fca6bbdcc0252db"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8ae12ccaec6ec74945d8c1ef39f2c1b8df779abc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a29c5d2dd2ef9a8617a9a6d5585696d5f149cd98"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c525772c304c971b0d3a1f2898dedbae653efe90"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: RISC-V: KVM: Serialize IMSIC attributes with vCPU migration", "id": "2554904", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554904"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-366", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nRISC-V: KVM: Serialize IMSIC attributes with vCPU migration\nKVM device ioctls are not serialized against KVM_RUN. As a result,\nkvm_riscv_aia_imsic_rw_attr() can snapshot the physical CPU and HGEI of\nan IMSIC VS-file before a concurrent vCPU migration releases it.\nThe HGEI can then be allocated to another vCPU before imsic_vsfile_rw()\nuses the stale tuple. A GET or SET attribute may consequently access the\nnew owner's interrupt file.\nSerialize the entire IMSIC attribute operation with the target vCPU\nmutex. This prevents the VS-file from being migrated and recycled until\nthe attribute access completes. Acquire the mutex killably so that the\ndevice ioctl remains interruptible while waiting for KVM_RUN to finish.", "A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) subsystem for the RISC-V architecture. Due to missing synchronization between interrupt controller device operations and virtual CPU (vCPU) execution, a local user with access to the KVM interface can trigger a race condition during concurrent processor migration. This flaw allows attribute read or write operations to target stale interrupt files, potentially leading to unauthorized data disclosure or modification of another virtual processor's interrupt state."], "name": "CVE-2026-98465", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98465\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98465\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98465.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[db8b7e97d6137a28b2bfc07e591d54da268f0c36,a29c5d2dd2ef9a8617a9a6d5585696d5f149cd98)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[db8b7e97d6137a28b2bfc07e591d54da268f0c36,c525772c304c971b0d3a1f2898dedbae653efe90)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[db8b7e97d6137a28b2bfc07e591d54da268f0c36,71acbea44e78665ea90e3c310fca6bbdcc0252db)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[db8b7e97d6137a28b2bfc07e591d54da268f0c36,8ae12ccaec6ec74945d8c1ef39f2c1b8df779abc)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.5"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.5)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T16:45:17.334948+00:00", "updated": "2026-10-24T15:30:14.536070+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}