{"id":"CVE-2026-99016","kind":"vulnerability","aliases":["CVE-2026-99016"],"related":[],"title":"Linux kernel RISC-V futex: tagged pointer lets unprivileged atomic writes to kernel memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: futex: untag the user pointer before the atomic access\n\naccess_ok() checks untagged_addr(uaddr), but arch_futex_atomic_op_inuser()\nand futex_atomic_cmpxchg_inatomic() hand the raw uaddr to the inline asm\namoswap/amoadd/.../lr.w+sc.w through the \"+m\" (*uaddr) operand.  When the\ntagged address ABI is enabled (CONFIG_RISCV_ISA_SUPM, prctl\nPR_SET_TAGGED_ADDR_CTRL with PMLEN != 0), those two addresses differ: a\nuser pointer whose top PMLEN bits hold a tag passes access_ok() after\nuntagging, but the atomic is then performed on the still-tagged raw\naddress.\n\nSupervisor-mode data accesses are not subject to the U-mode pointer\nmasking (that is governed by menvcfg.PMM, which the kernel does not set),\nso hardware does not strip the tag for the kernel's own access.  With\nSv57 and PMLEN=16 the tag bits overlap the canonical-address bits, so a\ntagged pointer can name a canonical kernel virtual address (e.g. in the\nlinear map) whose untagged form is a valid user address.  An unprivileged\nprocess can thus make FUTEX_WAKE_OP perform an atomic read-modify-write on\nan arbitrary kernel address, with the matching FUTEX_OP_CMP_* result\nserving as a read oracle.\n\nget_user()/put_user()/raw_copy_{to,from}_user() already untag the pointer\nafter the access_ok() check; do the same in the futex helpers so the\natomic operates on the address that was actually validated.","summary":"On RISC-V kernels with tagged address support, the futex helpers perform atomic operations on a raw tagged user pointer instead of the untagged address that passed the access check. A local unprivileged process can make FUTEX_WAKE_OP perform read-modify-write operations on an arbitrary kernel address and read results through the comparison outcome.","severity":"high","cvss":null,"epss":0.00206,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","riscv","runtime","self-hosted","shared-hosts"],"not_affected_if":["default-config","non-riscv","tagged-address-abi-disabled"],"how_to_check":"- Check the kernel version with `uname -r` and whether the machine is RISC-V with `uname -m`.\n- Check whether tagged address support is built in with `grep CONFIG_RISCV_ISA_SUPM /boot/config-$(uname -r)`.\n- Check whether the kernel was built with a fix by comparing against the vendor's kernel changelog for this CVE.","fix":"- Update the Linux kernel to a release that includes the upstream riscv futex untag fix for CVE-2026-99016; the exact fixed version is unknown from the sources.\n- Reboot into the patched kernel and confirm with `uname -r`.","status":"open","published_at":"2026-10-23T13:17:24+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:55:43+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:55:43Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream riscv futex untag fix for CVE-2026-99016; the exact fixed version is unknown from the sources.\n- Reboot into the patched kernel and confirm with `uname -r`.","reach":"local","title":"Linux kernel RISC-V futex: tagged pointer lets unprivileged atomic writes to kernel memory","impact":"high","summary":"On RISC-V kernels with tagged address support, the futex helpers perform atomic operations on a raw tagged user pointer instead of the untagged address that passed the access check. A local unprivileged process can make FUTEX_WAKE_OP perform read-modify-write operations on an arbitrary kernel address and read results through the comparison outcome.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","riscv","self-hosted","shared-hosts"],"confidence":0.6,"needs_auth":"yes","worst_case":"Local user performs atomic writes on kernel memory, leading to privilege escalation","analyst_note":"Find the upstream fix commit and the fixed stable kernel version for CVE-2026-99016 on NVD or kernel.org to fill in fix and how_to_check.","how_to_check":"- Check the kernel version with `uname -r` and whether the machine is RISC-V with `uname -m`.\n- Check whether tagged address support is built in with `grep CONFIG_RISCV_ISA_SUPM /boot/config-$(uname -r)`.\n- Check whether the kernel was built with a fix by comparing against the vendor's kernel changelog for this CVE.","needs_analyst":true,"not_affected_if":["non-riscv","tagged-address-abi-disabled","default-config"],"who_is_affected":"Only RISC-V systems with the tagged address ABI enabled (CONFIG_RISCV_ISA_SUPM and PR_SET_TAGGED_ADDR_CTRL with PMLEN set) and Sv57 paging are described as exposed. Any local user on such a machine can trigger it, so shared multi-user hosts matter most. Systems on other architectures are not described as affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000767,"input_tokens":3805,"output_tokens":773,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-99016':18A,21A '/lr.w':136C '/put_user':307C '/raw_copy_':308C '0':162C '16':238C 'abi':147C 'access':61B,109C,110C,178C,199C,233C,318C 'actual':337C 'addr':114C,158C 'address':39B,57B,82B,146C,165C,194C,246C,258C,271C,292C,334C 'alreadi':312C 'amoswap/amoadd':135C 'arbitrari':80B,290C 'arch':117C 'asm':134C 'atom':11A,45B,108C,119C,124C,184C,283C,330C 'bit':173C,241C,247C 'canon':245C,255C 'canonical-address':244C 'check':62B,112C,320C 'cmp':298C 'cmpxchg':125C 'comparison':88B 'config':150C 'ctrl':159C 'cve':16A,19A 'data':198C 'differ':166C 'e.g':259C 'enabl':149C 'follow':95C 'form':266C 'futex':6A,42B,69B,101C,118C,123C,278C,296C,326C 'get':305C 'govern':212C 'hand':127C 'hardwar':222C 'helper':43B,327C 'hold':174C 'host':28B,31B 'inatom':126C 'inlin':133C 'instead':53B 'inus':121C 'isa':152C 'kernel':2A,14A,22B,36B,81B,93C,217C,230C,256C,291C 'let':9A 'linear':262C 'linux':1A,23B,92C 'local':64B 'm':140C 'make':68B,277C 'map':263C 'mask':209C 'match':295C 'memori':15A 'menvcfg.pmm':214C 'mode':197C,207C 'modifi':75B,286C 'name':253C 'ok':111C,179C,319C 'op':71B,120C,280C,297C 'oper':46B,77B,331C 'operand':142C 'oracl':304C 'outcom':89B 'overlap':242C 'pass':59B,177C 'perform':44B,72B,187C,281C 'pmlen':161C,172C,237C 'pointer':8A,52B,105C,169C,208C,251C,315C 'pr':155C 'prctl':154C 'process':66B,274C 'raw':49B,129C,193C 'read':74B,84B,285C,303C 'read-modify-writ':73B,284C 'resolv':99C 'result':85B,299C 'risc':4A,34B 'risc-v':3A,33B 'riscv':24B,100C,151C 'runtim':25B 'sc.w':137C 'self':27B 'self-host':26B 'serv':300C 'set':156C,220C 'share':30B 'shared-host':29B 'still':191C 'still-tag':190C 'strip':225C 'subject':202C 'supervisor':196C 'supervisor-mod':195C 'supm':153C 'support':40B 'sv57':235C 'tag':7A,38B,50B,145C,157C,176C,192C,227C,240C,250C 'thus':276C 'top':171C 'two':164C 'u':206C 'u-mod':205C 'uaddr':115C,130C,141C 'unprivileg':10A,65B,273C 'untag':56B,102C,113C,181C,265C,313C 'user':51B,104C,168C,270C,306C,311C 'v':5A,35B 'valid':269C,338C 'virtual':257C 'vulner':96C 'wake':70B,279C 'whose':170C,264C 'write':12A,76B,287C","nicknames":[],"mitigations":[],"who_affected":"Only RISC-V systems with the tagged address ABI enabled (CONFIG_RISCV_ISA_SUPM and PR_SET_TAGGED_ADDR_CTRL with PMLEN set) and Sv57 paging are described as exposed. Any local user on such a machine can trigger it, so shared multi-user hosts matter most. Systems on other architectures are not described as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99016","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99016","severity":null,"published_at":"2026-10-23T13:17:24+00:00","modified_at":"2026-10-23T13:17:24+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-99016","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99016","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}