CVE-2026-99017

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99017", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.386Z", "datePublished": "2026-10-23T12:20:53.518Z", "dateUpdated": "2026-10-24T14:10:04.808Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-24T14:10:04.808Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE\n\nerrata_probe_ghostwrite() only marks the CPU as vulnerable when it is\ncalled at the RISCV_ALTERNATIVES_EARLY_BOOT stage, and the mitigation\nin ghostwrite_enable_mitigation() only takes effect if the vulnerable\nstate was recorded before the boot alternatives are patched.\n\nThe early boot stage is only executed when CONFIG_RISCV_ALTERNATIVE_EARLY\nis enabled, which currently is only selected by ERRATA_THEAD_MAE. In a\nkernel built with ERRATA_THEAD_GHOSTWRITE=y but ERRATA_THEAD_MAE=n, the\nearly alternatives never run, so ghostwrite_state is never set to\nVULNERABLE: ghostwrite_enable_mitigation() returns false, xtheadvector\nremains enabled, and sysfs reports \"Not affected\" on a vulnerable\nT-Head C9xx CPU.\n\nSelect RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE so that the\nvulnerability is detected in the early boot stage and the default\nmitigation is applied."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - A local process executes the GhostWrite vector sequence; its first vector instruction follows handle_exception() through do_trap_insn_illegal() to riscv_v_first_use_handler(), after which the faulty store executes in U-mode. No network protocol carries the causal input.\nAC:H - Exposure requires a vulnerable T-Head C9xx with xtheadvector and the unusual build combination ERRATA_THEAD_GHOSTWRITE=y plus ERRATA_THEAD_MAE=n; both errata options default to y, and an attacker cannot create this kernel configuration.\nPR:L - riscv_v_first_use_handler() and riscv_v_vstate_ctrl_set_current() contain no capability check, so an ordinary local user can enable vector state and execute the sequence; no administrative privilege or user namespace is required.\nUI:N - The attacking process itself enables or first-uses vector state and executes the faulty store; no victim must mount media, open a file, or perform another action.\nS:U - The missed disable_xtheadvector() call lets a user process escalate into the kernel on the same host; this is a local user-to-kernel privilege escalation under the host's existing security authority.\nC:H - Leaving xtheadvector enabled exposes GhostWrite's arbitrary physical-write primitive; overwriting a PTE's page-frame number creates an arbitrary physical-read mapping covering kernel and other-process memory.\nI:H - Because ghostwrite_enable_mitigation() returns false without the early VULNERABLE state, faulty high-order vector stores remain usable for attacker-chosen byte writes to physical memory, including PTEs and kernel or machine-mode code.\nA:H - The same unrestricted physical writes can corrupt kernel text, page tables, or device MMIO, causing an unrecoverable kernel crash or system hang."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/riscv/Kconfig.errata"], "versions": [{"version": "4bf97069239bcfca9840936313c7ac35a6e04488", "lessThan": "fa465a7819ecbe5801b78c088d3cadaf2664b8ca", "status": "affected", "versionType": "git"}, {"version": "4bf97069239bcfca9840936313c7ac35a6e04488", "lessThan": "7fee577a2fa78b9a76da015beec1ccf978746ebb", "status": "affected", "versionType": "git"}, {"version": "4bf97069239bcfca9840936313c7ac35a6e04488", "lessThan": "298510bbc7c3017c0faf481c6ea66f1065b657b4", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/riscv/Kconfig.errata"], "versions": [{"version": "6.14", "status": "affected"}, {"version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/fa465a7819ecbe5801b78c088d3cadaf2664b8ca"}, {"url": "https://git.kernel.org/stable/c/7fee577a2fa78b9a76da015beec1ccf978746ebb"}, {"url": "https://git.kernel.org/stable/c/298510bbc7c3017c0faf481c6ea66f1065b657b4"}], "title": "riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/riscv/Kconfig.errata"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "fa465a7819ecbe5801b78c088d3cadaf2664b8ca", "status": "affected", "version": "4bf97069239bcfca9840936313c7ac35a6e04488", "versionType": "git"}, {"lessThan": "7fee577a2fa78b9a76da015beec1ccf978746ebb", "status": "affected", "version": "4bf97069239bcfca9840936313c7ac35a6e04488", "versionType": "git"}, {"lessThan": "298510bbc7c3017c0faf481c6ea66f1065b657b4", "status": "affected", "version": "4bf97069239bcfca9840936313c7ac35a6e04488", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/riscv/Kconfig.errata"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"lessThan": "6.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE\n\nerrata_probe_ghostwrite() only marks the CPU as vulnerable when it is\ncalled at the RISCV_ALTERNATIVES_EARLY_BOOT stage, and the mitigation\nin ghostwrite_enable_mitigation() only takes effect if the vulnerable\nstate was recorded before the boot alternatives are patched.\n\nThe early boot stage is only executed when CONFIG_RISCV_ALTERNATIVE_EARLY\nis enabled, which currently is only selected by ERRATA_THEAD_MAE. In a\nkernel built with ERRATA_THEAD_GHOSTWRITE=y but ERRATA_THEAD_MAE=n, the\nearly alternatives never run, so ghostwrite_state is never set to\nVULNERABLE: ghostwrite_enable_mitigation() returns false, xtheadvector\nremains enabled, and sysfs reports \"Not affected\" on a vulnerable\nT-Head C9xx CPU.\n\nSelect RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE so that the\nvulnerability is detected in the early boot stage and the default\nmitigation is applied."}], "id": "CVE-2026-99017", "lastModified": "2026-10-24T14:16:52.790", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-23T13:17:24.530", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/298510bbc7c3017c0faf481c6ea66f1065b657b4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7fee577a2fa78b9a76da015beec1ccf978746ebb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fa465a7819ecbe5801b78c088d3cadaf2664b8ca"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: failure to apply Ghostwrite mitigation via missing early boot errata selection", "id": "2559725", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559725"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-440", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nriscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE\nerrata_probe_ghostwrite() only marks the CPU as vulnerable when it is\ncalled at the RISCV_ALTERNATIVES_EARLY_BOOT stage, and the mitigation\nin ghostwrite_enable_mitigation() only takes effect if the vulnerable\nstate was recorded before the boot alternatives are patched.\nThe early boot stage is only executed when CONFIG_RISCV_ALTERNATIVE_EARLY\nis enabled, which currently is only selected by ERRATA_THEAD_MAE. In a\nkernel built with ERRATA_THEAD_GHOSTWRITE=y but ERRATA_THEAD_MAE=n, the\nearly alternatives never run, so ghostwrite_state is never set to\nVULNERABLE: ghostwrite_enable_mitigation() returns false, xtheadvector\nremains enabled, and sysfs reports \"Not affected\" on a vulnerable\nT-Head C9xx CPU.\nSelect RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE so that the\nvulnerability is detected in the early boot stage and the default\nmitigation is applied.", "A flaw was found in the Linux kernel. Under specific configurations on RISC-V systems using T-Head processors, the kernel does not execute early boot checks required to identify hardware errata. As a result, the default mitigation for the Ghostwrite hardware vulnerability is not applied, which may allow a local attacker to exploit unmitigated CPU flaws to access unauthorized data or compromise system integrity."], "mitigation": {"lang": "en:us", "value": "--- CME Mitigation Guidance (2026-11-02) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\nThe highest-value action is to enable early boot alternatives probing by ensuring CONFIG_RISCV_ALTERNATIVE_EARLY is active in kernel builds supporting T-Head Ghostwrite errata mitigations: upgrade to the fixed Kernel/Kernel Ivos Qualcomm builds, which select RISCV_ALTERNATIVE_EARLY automatically when ERRATA_THEAD_GHOSTWRITE is enabled in Kconfig, closing execution of xtheadvector instruction sequences by an unprivileged local user. Until patched, this is only a concern on RISC-V systems utilizing vulnerable T-Head C9xx processors running kernels configured with CONFIG_ERRATA_THEAD_GHOSTWRITE=y and CONFIG_ERRATA_THEAD_MAE=n \u2014 Non-RISC-V architectures and standard Red Hat Enterprise Linux distributions that do not support RISC-V are unaffected \u2014 so Restrict untrusted local user access and execution on affected RISC-V hosts, or recompile the kernel with CONFIG_ERRATA_THEAD_MAE=y so early alternatives execute. As a compensating measure, Deploy SELinux in enforcing mode to confine compromised processes to their domain if Ghostwrite memory corruption occurs and Map unprivileged local user sessions to confined SELinux domains to restrict post-exploitation access following hardware memory manipulation. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing early boot errata selection defect \u2014 apply the upstream patch to fully remediate.\nHighest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)"}, "name": "CVE-2026-99017", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-10", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-10-23T12:20:53Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99017\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99017\nhttps://git.kernel.org/stable/c/298510bbc7c3017c0faf481c6ea66f1065b657b4\nhttps://git.kernel.org/stable/c/7fee577a2fa78b9a76da015beec1ccf978746ebb\nhttps://git.kernel.org/stable/c/fa465a7819ecbe5801b78c088d3cadaf2664b8ca"], "statement": "This vulnerability is rated as Moderate impact because exploitation requires local access on specific hardware architectures and depends on an uncommon kernel compile-time configuration. Standard Red Hat Enterprise Linux distributions do not support or distribute kernels for the RISC-V architecture, meaning Red Hat environments are not directly affected by this flaw. On platforms where applicable, bypassing early processor errata discovery prevents runtime mitigation of the Ghostwrite issue, leaving unprivileged local processes capable of corrupting system memory.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4bf97069239bcfca9840936313c7ac35a6e04488,fa465a7819ecbe5801b78c088d3cadaf2664b8ca)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4bf97069239bcfca9840936313c7ac35a6e04488,7fee577a2fa78b9a76da015beec1ccf978746ebb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4bf97069239bcfca9840936313c7ac35a6e04488,298510bbc7c3017c0faf481c6ea66f1065b657b4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4bf97069239bcfca9840936313c7ac35a6e04488,fa465a7819ecbe5801b78c088d3cadaf2664b8ca)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4bf97069239bcfca9840936313c7ac35a6e04488,7fee577a2fa78b9a76da015beec1ccf978746ebb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4bf97069239bcfca9840936313c7ac35a6e04488,298510bbc7c3017c0faf481c6ea66f1065b657b4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.57,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.11,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-23T15:30:14.846434+00:00", "updated": "2026-11-03T03:30:14.297117+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}