{"id":"CVE-2026-99017","kind":"vulnerability","aliases":["CVE-2026-99017"],"related":[],"title":"Linux kernel: RISC-V GHOSTWRITE mitigation skipped, vulnerable T-Head CPUs report unaffected","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE\n\nerrata_probe_ghostwrite() only marks the CPU as vulnerable when it is\ncalled at the RISCV_ALTERNATIVES_EARLY_BOOT stage, and the mitigation\nin ghostwrite_enable_mitigation() only takes effect if the vulnerable\nstate was recorded before the boot alternatives are patched.\n\nThe early boot stage is only executed when CONFIG_RISCV_ALTERNATIVE_EARLY\nis enabled, which currently is only selected by ERRATA_THEAD_MAE. In a\nkernel built with ERRATA_THEAD_GHOSTWRITE=y but ERRATA_THEAD_MAE=n, the\nearly alternatives never run, so ghostwrite_state is never set to\nVULNERABLE: ghostwrite_enable_mitigation() returns false, xtheadvector\nremains enabled, and sysfs reports \"Not affected\" on a vulnerable\nT-Head C9xx CPU.\n\nSelect RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE so that the\nvulnerability is detected in the early boot stage and the default\nmitigation is applied.","summary":"In kernel builds with the THEAD GHOSTWRITE errata option on but the MAE option off, the early boot alternatives never run, so vulnerable T-Head C9xx RISC-V CPUs are not detected and the mitigation is not applied. The sysfs status wrongly reports 'Not affected', leaving the xtheadvector feature enabled on affected hardware.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","riscv","self-hosted","t-head-c9xx"],"not_affected_if":["default-config","non-riscv-hardware"],"how_to_check":"- Check the kernel config for `CONFIG_ERRATA_THEAD_GHOSTWRITE=y` with `CONFIG_ERRATA_THEAD_MAE` unset or `n`, e.g. `grep -E 'ERRATA_THEAD_(GHOSTWRITE|MAE)' /boot/config-$(uname -r)`\n- Confirm the CPU is a T-Head C9xx core and read the vulnerability status under sysfs for the GHOSTWRITE entry","fix":"- Update the Linux kernel to a release that includes the upstream commit selecting RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE (exact fixed version unknown from the sources)\n- Until updated, enable `CONFIG_ERRATA_THEAD_MAE` in the kernel build if the hardware is a vulnerable T-Head C9xx system","status":"open","published_at":"2026-10-23T13:17:24+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:55:42+00:00","updated_at":"2026-10-25T04:55:42+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:55:42Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit selecting RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE (exact fixed version unknown from the sources)\n- Until updated, enable `CONFIG_ERRATA_THEAD_MAE` in the kernel build if the hardware is a vulnerable T-Head C9xx system","reach":"local","title":"Linux kernel: RISC-V GHOSTWRITE mitigation skipped, vulnerable T-Head CPUs report unaffected","impact":"medium","summary":"In kernel builds with the THEAD GHOSTWRITE errata option on but the MAE option off, the early boot alternatives never run, so vulnerable T-Head C9xx RISC-V CPUs are not detected and the mitigation is not applied. The sysfs status wrongly reports 'Not affected', leaving the xtheadvector feature enabled on affected hardware.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","riscv","t-head-c9xx","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"vulnerable CPU's GHOSTWRITE mitigation silently skipped, leaving hardware exposed","analyst_note":"Find the upstream kernel commit and the first fixed stable release for CVE-2026-99017 from the NVD entry, and confirm the exploit reach and impact.","how_to_check":"- Check the kernel config for `CONFIG_ERRATA_THEAD_GHOSTWRITE=y` with `CONFIG_ERRATA_THEAD_MAE` unset or `n`, e.g. `grep -E 'ERRATA_THEAD_(GHOSTWRITE|MAE)' /boot/config-$(uname -r)`\n- Confirm the CPU is a T-Head C9xx core and read the vulnerability status under sysfs for the GHOSTWRITE entry","needs_analyst":true,"not_affected_if":["non-riscv-hardware","default-config"],"who_is_affected":"Only RISC-V systems with T-Head C9xx CPUs running a kernel built with ERRATA_THEAD_GHOSTWRITE=y and ERRATA_THEAD_MAE=n. Systems on other RISC-V cores, or kernels that enable the MAE option, are not described as affected by this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000808,"input_tokens":3685,"output_tokens":879,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-99017':18A,21A 'affect':80B,87B,212C 'altern':52B,103C,124C,147C,160C,189C,223C 'appli':73B,245C 'boot':51B,126C,146C,152C,238C 'build':36B 'built':176C 'c9xx':33B,60B,219C 'call':120C 'config':158C 'cpu':114C,220C 'cpus':13A,64B 'current':165C 'cve':16A,19A 'default':242C 'detect':67B,234C 'earli':50B,104C,125C,151C,161C,188C,224C,237C 'effect':137C 'enabl':85B,133C,163C,201C,207C 'errata':41B,100C,108C,170C,178C,183C,226C 'execut':156C 'fals':204C 'featur':84B 'follow':94C 'ghostwrit':6A,40B,107C,110C,132C,180C,193C,200C,228C 'hardwar':88B 'head':12A,32B,59B,218C 'host':29B 'infrastructur':22B 'kernel':2A,25B,35B,92C,175C 'leav':81B 'linux':1A,24B,91C 'linux-kernel':23B 'mae':46B,172C,185C 'mark':112C 'mitig':7A,70B,130C,134C,202C,243C 'n':186C 'never':53B,190C,196C 'option':42B,47B 'patch':149C 'probe':109C 'record':143C 'remain':206C 'report':14A,78B,210C 'resolv':98C 'return':203C 'risc':4A,62B 'risc-v':3A,61B 'riscv':26B,99C,102C,123C,159C,222C 'run':54B,191C 'select':101C,168C,221C 'self':28B 'self-host':27B 'set':197C 'skip':8A 'stage':127C,153C,239C 'state':141C,194C 'status':76B 'sysf':75B,209C 't-head':10A,57B,216C 't-head-c9xx':30B 'take':136C 'thead':39B,106C,171C,179C,184C,227C 'unaffect':15A 'v':5A,63B 'vulner':9A,56B,95C,116C,140C,199C,215C,232C 'wrong':77B 'xtheadvector':83B,205C 'y':181C","nicknames":[],"mitigations":[],"who_affected":"Only RISC-V systems with T-Head C9xx CPUs running a kernel built with ERRATA_THEAD_GHOSTWRITE=y and ERRATA_THEAD_MAE=n. Systems on other RISC-V cores, or kernels that enable the MAE option, are not described as affected by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99017","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99017","severity":null,"published_at":"2026-10-23T13:17:24+00:00","modified_at":"2026-10-23T13:17:24+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}