CVE-2026-98639

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98639", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.361Z", "datePublished": "2026-10-18T15:20:10.591Z", "dateUpdated": "2026-10-19T09:23:09.004Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:23:09.004Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: riscv: Fix NACL hfence entry update order\n\nThe SBI v3.0 specification (section 15.1.2) requires a nested HFENCE\nentry to be populated as follows:\n1) find an unused entry with Config.Pending == 0\n2) update the Page_Number and Page_Count words\n3) update the Config word with Config.Pending set\n\n__kvm_riscv_nacl_hfence() writes the Config word first, so the SBI\nimplementation (or NACL hardware) can observe a pending entry with\npnum/pcount values left over from the previous use of that entry,\nresulting in incorrect TLB flush ranges.\n\nWrite pnum and pcount first and the Config word last. Since the\nconsumer is an external agent on coherent shared memory, use\nWRITE_ONCE() to stop the compiler from reordering the stores and\nsmp_wmb() to make the parameter words globally visible before the\nPending bit is set."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/riscv/kvm/nacl.c"], "versions": [{"version": "d466c19cead5904d4d5d92adb2b213b411d3b849", "lessThan": "d6de766d8d26d71b714f548192099112def50a9c", "status": "affected", "versionType": "git"}, {"version": "d466c19cead5904d4d5d92adb2b213b411d3b849", "lessThan": "6da466502621381fa88a6684290923d25c559266", "status": "affected", "versionType": "git"}, {"version": "d466c19cead5904d4d5d92adb2b213b411d3b849", "lessThan": "b3d346838ec65fac7fd83f5dbcedd13cadfffddb", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/riscv/kvm/nacl.c"], "versions": [{"version": "6.13", "status": "affected"}, {"version": "0", "lessThan": "6.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d6de766d8d26d71b714f548192099112def50a9c"}, {"url": "https://git.kernel.org/stable/c/6da466502621381fa88a6684290923d25c559266"}, {"url": "https://git.kernel.org/stable/c/b3d346838ec65fac7fd83f5dbcedd13cadfffddb"}], "title": "KVM: riscv: Fix NACL hfence entry update order", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/riscv/kvm/nacl.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d6de766d8d26d71b714f548192099112def50a9c", "status": "affected", "version": "d466c19cead5904d4d5d92adb2b213b411d3b849", "versionType": "git"}, {"lessThan": "6da466502621381fa88a6684290923d25c559266", "status": "affected", "version": "d466c19cead5904d4d5d92adb2b213b411d3b849", "versionType": "git"}, {"lessThan": "b3d346838ec65fac7fd83f5dbcedd13cadfffddb", "status": "affected", "version": "d466c19cead5904d4d5d92adb2b213b411d3b849", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/riscv/kvm/nacl.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"lessThan": "6.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: riscv: Fix NACL hfence entry update order\n\nThe SBI v3.0 specification (section 15.1.2) requires a nested HFENCE\nentry to be populated as follows:\n1) find an unused entry with Config.Pending == 0\n2) update the Page_Number and Page_Count words\n3) update the Config word with Config.Pending set\n\n__kvm_riscv_nacl_hfence() writes the Config word first, so the SBI\nimplementation (or NACL hardware) can observe a pending entry with\npnum/pcount values left over from the previous use of that entry,\nresulting in incorrect TLB flush ranges.\n\nWrite pnum and pcount first and the Config word last. Since the\nconsumer is an external agent on coherent shared memory, use\nWRITE_ONCE() to stop the compiler from reordering the stores and\nsmp_wmb() to make the parameter words globally visible before the\nPending bit is set."}], "id": "CVE-2026-98639", "lastModified": "2026-10-19T10:19:28.133", "metrics": {}, "published": "2026-10-18T16:17:17.020", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6da466502621381fa88a6684290923d25c559266"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b3d346838ec65fac7fd83f5dbcedd13cadfffddb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d6de766d8d26d71b714f548192099112def50a9c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Incorrect TLB flushing in RISC-V KVM via improper nested acceleration update order", "id": "2555005", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555005"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H", "status": "draft"}, "cwe": "CWE-362", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nKVM: riscv: Fix NACL hfence entry update order\nThe SBI v3.0 specification (section 15.1.2) requires a nested HFENCE\nentry to be populated as follows:\n1) find an unused entry with Config.Pending == 0\n2) update the Page_Number and Page_Count words\n3) update the Config word with Config.Pending set\n__kvm_riscv_nacl_hfence() writes the Config word first, so the SBI\nimplementation (or NACL hardware) can observe a pending entry with\npnum/pcount values left over from the previous use of that entry,\nresulting in incorrect TLB flush ranges.\nWrite pnum and pcount first and the Config word last. Since the\nconsumer is an external agent on coherent shared memory, use\nWRITE_ONCE() to stop the compiler from reordering the stores and\nsmp_wmb() to make the parameter words globally visible before the\nPending bit is set.", "A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for the RISC-V architecture. During nested virtualization acceleration, control flags are written before the target page parameters are properly committed to shared memory. Consequently, the supervisor interface or underlying hardware can process outdated parameters, resulting in incorrect flushes of the Translation Lookaside Buffer (TLB, a cache used to speed up memory address translation). A local user or guest virtual machine could exploit this behavior to cause memory corruption, expose stale memory data, or induce a denial of service (DoS)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-98639", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-10-18T15:20:10Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98639\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98639\nhttps://git.kernel.org/stable/c/6da466502621381fa88a6684290923d25c559266\nhttps://git.kernel.org/stable/c/b3d346838ec65fac7fd83f5dbcedd13cadfffddb\nhttps://git.kernel.org/stable/c/d6de766d8d26d71b714f548192099112def50a9c\nhttps://kernelcve.org/list/?q=CVE-2026-98639"], "statement": "The KVM RISC-V NACL HFENCE producer can set Config.Pending before updating Page_Number and Page_Count. The SBI implementation or NACL hardware may therefore consume stale range parameters and flush the wrong TLB entries while the intended translations remain active. A stale translation can potentially preserve access to a page after its mapping has changed, which creates a plausible confidentiality and integrity risk across a virtualization boundary and can also cause crashes or guest corruption. For the CVSS the PR:L value is used because an attacker needs controlled execution in a guest or nested virtualization context but does not need administrative privileges on the host. AC:H is used because successful triggering depends on the external consumer observing the entry during a narrow store ordering window. The issue is not directly network reachable.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d466c19cead5904d4d5d92adb2b213b411d3b849,d6de766d8d26d71b714f548192099112def50a9c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d466c19cead5904d4d5d92adb2b213b411d3b849,d6a466502621381fa88a6684290923d25c559266)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d466c19cead5904d4d5d92adb2b213b411d3b849,b3d346838ec65fac7fd83f5dbcedd13cadfffddb)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T23:15:14.327564+00:00", "updated": "2026-10-22T22:15:12.871346+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}