Live › vulnerability › CVE-2026-98465
Go to dashboardA race in the Linux kernel's RISC-V KVM code lets a device ioctl read or write the interrupt file of a different virtual CPU after a concurrent vCPU migration recycles it. The sources describe the bug and its fix, but do not state an attacker's achievable impact.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Hosts running the Linux kernel with RISC-V KVM and an in-kernel AIA/IMSIC interrupt controller for virtual machines are the ones in scope. Systems without RISC-V KVM virtualization, and non-RISC-V hosts, are not affected by this bug.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
RISC-V: KVM: Serialize IMSIC attributes with vCPU migration
KVM device ioctls are not serialized against KVM_RUN. As a result, kvm_riscv_aia_imsic_rw_attr() can snapshot the physical CPU and HGEI of an IMSIC VS-file before a concurrent vCPU migration releases it.
The HGEI can then be allocated to another vCPU before imsic_vsfile_rw() uses the stale tuple. A GET or SET attribute may consequently access the new owner's interrupt file.
Serialize the entire IMSIC attribute operation with the target vCPU mutex. This prevents the VS-file from being migrated and recycled until the attribute access completes. Acquire the mutex killably so that the device ioctl remains interruptible while waiting for KVM_RUN to finish.
This page as .md · .json · in your agent: get_signal("CVE-2026-98465")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.