Skip to content
Heist/ feed
Critical

RISC-V: KVM: Synchronize hrtimer callback during teardown

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during teardown The non-Sstc hrtimer callback clears next_set before its final uses of the enclosing vCPU. If teardown observes next_set as false while the callback is still running, kvm_riscv_vcpu_timer_cancel() skips hrtimer_cancel() and kvm_destroy_vcpus() can free the vCPU before the callback enters kvm_riscv_vcpu_set_interrupt(). A guest can arm the timer with SBI TIME and request shutdown with SBI legacy shutdown or SRST. A VMM that honors KVM_EXIT_SYSTEM_EVENT and destroys the VM supplies the teardown side of the race; no post-launch host ioctl is needed to arm or request teardown. On upstream master 62cc90241548, generic KASAN reported: BUG: KASAN: slab-use-after-free in do_raw_spin_lock Write of size 4 at addr ff60000005e58898 kvm_riscv_vcpu_set_interrupt kvm_riscv_vcpu_hrtimer_expired __hrtimer_run_queues hrtimer_interrupt The object was allocated by KVM_CREATE_VCPU and freed concurrently by: kvm_destroy_vcpus kvm_arch_destroy_vm kvm_destroy_vm __fput For deterministic validation, I added mdelay(1000) immediately after the existing next_set = false assignment. This only widens the existing post-clear callback window. A no-delay trace build naturally reached the callback-after-teardown-start/before-deinit ordering in 12 of 200 runs, but 1,500 stock-kernel stress iterations did not produce a KASAN report, so natural reproduction is timing-sensitive. Always inv

Announced Source revision 1
Original source ↗

CVE-2026-98464

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-98464

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "3a9f66cb25e18a3eeca36c08d9f823a35b3ddc22",
        "lessThan": "9bdbae64ae0dab93041ebc57ec4e93def793fc2d",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "3a9f66cb25e18a3eeca36c08d9f823a35b3ddc22",
        "lessThan": "2af03b606aadaaeb386658ef798c79bdcdef87c1",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "3a9f66cb25e18a3eeca36c08d9f823a35b3ddc22",
        "lessThan": "e66aced74f0122380603c9910a71d77618b28f0e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "3a9f66cb25e18a3eeca36c08d9f823a35b3ddc22",
        "lessThan": "ea91f05a55b807ead3166546a2c75f4185ca645f",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "3a9f66cb25e18a3eeca36c08d9f823a35b3ddc22",
        "lessThan": "3cc6184bd5920c9685d87f4e260568feba08650d",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "3a9f66cb25e18a3eeca36c08d9f823a35b3ddc22",
        "lessThan": "aaad136d56d91252517272b68cd533e5714698d5",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "arch/riscv/kvm/vcpu_timer.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.16"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.16",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.1.189",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.158",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.112",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.55",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.2.9",
        "versionType": "semver",
        "lessThanOrEqual": "7.2.*"
      },
      {
        "status": "unaffected",
        "version": "7.3",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "arch/riscv/kvm/vcpu_timer.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-98464

Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event
#55596 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement