Live › vulnerability › CVE-2026-98639
Go to dashboardOn RISC-V hosts running KVM, the kernel wrote the nested HFENCE entry's config word before its page number and count words, so the SBI implementation or hardware could act on stale range values from an earlier use of that entry. The fix writes the parameter words first, then the config word, with memory barriers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only hosts running the Linux kernel on RISC-V with KVM virtualization and the nested acceleration (NACL) SBI extension in use. Standard x86 or ARM hosts, and RISC-V machines not running KVM guests, are not affected.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
KVM: riscv: Fix NACL hfence entry update order
The SBI v3.0 specification (section 15.1.2) requires a nested HFENCE entry to be populated as follows:
__kvm_riscv_nacl_hfence() writes the Config word first, so the SBI implementation (or NACL hardware) can observe a pending entry with pnum/pcount values left over from the previous use of that entry, resulting in incorrect TLB flush ranges.
Write pnum and pcount first and the Config word last. Since the consumer is an external agent on coherent shared memory, use WRITE_ONCE() to stop the compiler from reordering the stores and smp_wmb() to make the parameter words globally visible before the Pending bit is set.
This page as .md · .json · in your agent: get_signal("CVE-2026-98639")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.