Live › vulnerability › CVE-2026-99017
Go to dashboardIn kernel builds with the THEAD GHOSTWRITE errata option on but the MAE option off, the early boot alternatives never run, so vulnerable T-Head C9xx RISC-V CPUs are not detected and the mitigation is not applied. The sysfs status wrongly reports 'Not affected', leaving the xtheadvector feature enabled on affected hardware.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only RISC-V systems with T-Head C9xx CPUs running a kernel built with ERRATA_THEAD_GHOSTWRITE=y and ERRATA_THEAD_MAE=n. Systems on other RISC-V cores, or kernels that enable the MAE option, are not described as affected by this flaw.
No product ranges from the sources yet.
CONFIG_ERRATA_THEAD_GHOSTWRITE=y with CONFIG_ERRATA_THEAD_MAE unset or n, e.g. grep -E 'ERRATA_THEAD_(GHOSTWRITE|MAE)' /boot/config-$(uname -r)CONFIG_ERRATA_THEAD_MAE in the kernel build if the hardware is a vulnerable T-Head C9xx systemEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE
errata_probe_ghostwrite() only marks the CPU as vulnerable when it is called at the RISCV_ALTERNATIVES_EARLY_BOOT stage, and the mitigation in ghostwrite_enable_mitigation() only takes effect if the vulnerable state was recorded before the boot alternatives are patched.
The early boot stage is only executed when CONFIG_RISCV_ALTERNATIVE_EARLY is enabled, which currently is only selected by ERRATA_THEAD_MAE. In a kernel built with ERRATA_THEAD_GHOSTWRITE=y but ERRATA_THEAD_MAE=n, the early alternatives never run, so ghostwrite_state is never set to VULNERABLE: ghostwrite_enable_mitigation() returns false, xtheadvector remains enabled, and sysfs reports "Not affected" on a vulnerable T-Head C9xx CPU.
Select RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE so that the vulnerability is detected in the early boot stage and the default mitigation is applied.
This page as .md · .json · in your agent: get_signal("CVE-2026-99017")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.