CVE-2026-23217 Overview
A deadlock vulnerability has been identified in the Linux kernel affecting RISC-V architecture systems. The flaw exists in the sbi_ecall.c functions when combined with the ftrace snapshot feature. When tracing is enabled on __sbi_ecall functions, triggering a snapshot of the ring buffer can cause the kernel to enter an infinite loop and deadlock state.
The vulnerability occurs because the snapshot code raises an IPI (Inter-Processor Interrupt) interrupt, which in turn results in another call to __sbi_ecall and triggers another snapshot, creating an endless recursive loop. This is particularly problematic on RISC-V systems without the SSTC (Supervisor-mode Timer and Counter) extension, where clock events in timer-riscv.c issue periodic SBI ecalls, making the deadlock condition trivially easy to trigger.
Critical Impact
Local attackers or misconfigured tracing settings can cause a complete system deadlock on affected RISC-V Linux systems, resulting in denial of service requiring a hard reboot.
Affected Products
- Linux kernel (RISC-V architecture)
- RISC-V systems without SSTC extension
- Systems with CONFIG_RISCV_ALTERNATIVE_EARLY not set
Discovery Timeline
- 2026-02-18 - CVE-2026-23217 published to NVD
- 2026-02-18 - Last updated in NVD database
Technical Details for CVE-2026-23217
Vulnerability Analysis
This vulnerability represents a classic deadlock condition caused by recursive function invocation through interrupt handling. The root issue lies in the interaction between the kernel's ftrace subsystem and the RISC-V Supervisor Binary Interface (SBI) ecall mechanism.
When a user or process configures ftrace to snapshot the __sbi_ecall function via the /sys/kernel/tracing/set_ftrace_filter interface, any subsequent SBI ecall triggers the snapshot mechanism. The snapshot code internally raises an IPI interrupt to synchronize data across processors. However, this IPI handling path itself invokes __sbi_ecall, which triggers another snapshot, creating an infinite recursion that rapidly exhausts system resources and causes a deadlock.
The condition becomes particularly severe on RISC-V systems lacking the SSTC extension because the timer subsystem (timer-riscv.c) periodically issues SBI ecalls for clock events. This means the vulnerability can be triggered passively without any explicit user action beyond enabling tracing on the affected functions.
Root Cause
The root cause is the absence of proper exclusion of sbi_ecall.c functions from the ftrace tracing framework. While functions in sbi_ecall.c are excluded when CONFIG_RISCV_ALTERNATIVE_EARLY is set, this configuration is not universally enabled, leaving many RISC-V deployments vulnerable to this deadlock condition.
The fix addresses this by unconditionally excluding all sbi_ecall.c functions from function tracing, regardless of kernel configuration options. Since SBI ecalls can be effectively logged via dedicated trace events, excluding these functions from general function tracing does not significantly limit debugging capabilities.
Attack Vector
The vulnerability can be exploited locally by any user with write access to the ftrace control files in /sys/kernel/tracing/. An attacker can trigger the deadlock by writing a snapshot filter for the __sbi_ecall function:
The attack requires local access to the tracing interface, typically available to root or users with appropriate capabilities. Once the filter is set, the next SBI ecall (which occurs frequently due to timer interrupts on systems without SSTC) will trigger the infinite loop and system deadlock.
Detection Methods for CVE-2026-23217
Indicators of Compromise
- System hangs or becomes completely unresponsive on RISC-V platforms
- Kernel log entries showing ftrace snapshot operations on __sbi_ecall functions immediately before system freeze
- Presence of suspicious entries in /sys/kernel/tracing/set_ftrace_filter referencing __sbi_ecall:snapshot
- Unexpected modifications to ftrace configuration files by non-administrative users
Detection Strategies
- Monitor access to /sys/kernel/tracing/set_ftrace_filter for suspicious write operations
- Audit kernel configuration to verify CONFIG_RISCV_ALTERNATIVE_EARLY status on RISC-V systems
- Implement file integrity monitoring on ftrace control interfaces
- Review system logs for patterns indicating recursive snapshot triggers before system hangs
Monitoring Recommendations
- Deploy endpoint detection solutions capable of monitoring kernel subsystem interactions
- Configure audit rules for tracing-related file modifications in /sys/kernel/tracing/
- Establish baseline ftrace configurations and alert on unauthorized changes
- Monitor for sudden system hangs on RISC-V infrastructure that require hard reboots
How to Mitigate CVE-2026-23217
Immediate Actions Required
- Apply the latest kernel patches that exclude sbi_ecall.c functions from tracing
- Restrict access to /sys/kernel/tracing/ to only trusted administrative users
- Enable CONFIG_RISCV_ALTERNATIVE_EARLY if possible in kernel configurations
- Consider disabling ftrace on production RISC-V systems if not actively needed
Patch Information
The Linux kernel development team has released patches to address this vulnerability. The fix ensures that all sbi_ecall.c functions are unconditionally excluded from function tracing, preventing the recursive snapshot deadlock condition.
Patches are available through the following kernel git commits:
Organizations running RISC-V Linux systems should update to kernel versions containing these fixes as soon as possible.
Workarounds
- Enable CONFIG_RISCV_ALTERNATIVE_EARLY in kernel configuration and rebuild the kernel
- Manually remove any __sbi_ecall entries from ftrace filters by clearing /sys/kernel/tracing/set_ftrace_filter
- Restrict write permissions on /sys/kernel/tracing/ directory to prevent unauthorized filter modifications
- Use dedicated SBI trace events instead of function tracing for monitoring ecall activity
# Clear existing ftrace filters on RISC-V systems
echo "" > /sys/kernel/tracing/set_ftrace_filter
# Restrict tracing directory access
chmod 700 /sys/kernel/tracing/
chown root:root /sys/kernel/tracing/
# Verify no sbi_ecall functions are being traced
grep sbi /sys/kernel/tracing/set_ftrace_filter
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
