---
id: "CVE-2026-99017"
kind: "vulnerability"
aliases: ["CVE-2026-99017"]
title: "Linux kernel: RISC-V GHOSTWRITE mitigation skipped, vulnerable T-Head CPUs report unaffected"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "linux-kernel", "riscv", "self-hosted", "t-head-c9xx"]
not_affected_if: ["default-config", "non-riscv-hardware"]
published_at: "2026-10-23T13:17:24+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T04:55:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99017", "first_seen_at": "2026-10-23T21:57:33+00:00"}]
---

# Linux kernel: RISC-V GHOSTWRITE mitigation skipped, vulnerable T-Head CPUs report unaffected

In kernel builds with the THEAD GHOSTWRITE errata option on but the MAE option off, the early boot alternatives never run, so vulnerable T-Head C9xx RISC-V CPUs are not detected and the mitigation is not applied. The sysfs status wrongly reports 'Not affected', leaving the xtheadvector feature enabled on affected hardware.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the kernel config for `CONFIG_ERRATA_THEAD_GHOSTWRITE=y` with `CONFIG_ERRATA_THEAD_MAE` unset or `n`, e.g. `grep -E 'ERRATA_THEAD_(GHOSTWRITE|MAE)' /boot/config-$(uname -r)`
- Confirm the CPU is a T-Head C9xx core and read the vulnerability status under sysfs for the GHOSTWRITE entry

## Fix

- Update the Linux kernel to a release that includes the upstream commit selecting RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE (exact fixed version unknown from the sources)
- Until updated, enable `CONFIG_ERRATA_THEAD_MAE` in the kernel build if the hardware is a vulnerable T-Head C9xx system

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99017

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE

errata_probe_ghostwrite() only marks the CPU as vulnerable when it is
called at the RISCV_ALTERNATIVES_EARLY_BOOT stage, and the mitigation
in ghostwrite_enable_mitigation() only takes effect if the vulnerable
state was recorded before the boot alternatives are patched.

The early boot stage is only executed when CONFIG_RISCV_ALTERNATIVE_EARLY
is enabled, which currently is only selected by ERRATA_THEAD_MAE. In a
kernel built with ERRATA_THEAD_GHOSTWRITE=y but ERRATA_THEAD_MAE=n, the
early alternatives never run, so ghostwrite_state is never set to
VULNERABLE: ghostwrite_enable_mitigation() returns false, xtheadvector
remains enabled, and sysfs reports "Not affected" on a vulnerable
T-Head C9xx CPU.

Select RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE so that the
vulnerability is detected in the early boot stage and the default
mitigation is applied.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_