CVE-2026-23217: Linux Kernel Trace Snapshot DoS Vulnerability

CVE-2026-23217 Overview

A deadlock vulnerability has been identified in the Linux kernel affecting RISC-V architecture systems. The flaw exists in the sbi_ecall.c functions when combined with the ftrace snapshot feature. When tracing is enabled on __sbi_ecall functions, triggering a snapshot of the ring buffer can cause the kernel to enter an infinite loop and deadlock state.

The vulnerability occurs because the snapshot code raises an IPI (Inter-Processor Interrupt) interrupt, which in turn results in another call to __sbi_ecall and triggers another snapshot, creating an endless recursive loop. This is particularly problematic on RISC-V systems without the SSTC (Supervisor-mode Timer and Counter) extension, where clock events in timer-riscv.c issue periodic SBI ecalls, making the deadlock condition trivially easy to trigger.

Critical Impact
Local attackers or misconfigured tracing settings can cause a complete system deadlock on affected RISC-V Linux systems, resulting in denial of service requiring a hard reboot.

Affected Products

Linux kernel (RISC-V architecture)
RISC-V systems without SSTC extension
Systems with CONFIG_RISCV_ALTERNATIVE_EARLY not set

Discovery Timeline

2026-02-18 - CVE-2026-23217 published to NVD
2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-23217

Vulnerability Analysis

This vulnerability represents a classic deadlock condition caused by recursive function invocation through interrupt handling. The root issue lies in the interaction between the kernel's ftrace subsystem and the RISC-V Supervisor Binary Interface (SBI) ecall mechanism.

When a user or process configures ftrace to snapshot the __sbi_ecall function via the /sys/kernel/tracing/set_ftrace_filter interface, any subsequent SBI ecall triggers the snapshot mechanism. The snapshot code internally raises an IPI interrupt to synchronize data across processors. However, this IPI handling path itself invokes __sbi_ecall, which triggers another snapshot, creating an infinite recursion that rapidly exhausts system resources and causes a deadlock.

The condition becomes particularly severe on RISC-V systems lacking the SSTC extension because the timer subsystem (timer-riscv.c) periodically issues SBI ecalls for clock events. This means the vulnerability can be triggered passively without any explicit user action beyond enabling tracing on the affected functions.

Root Cause

The root cause is the absence of proper exclusion of sbi_ecall.c functions from the ftrace tracing framework. While functions in sbi_ecall.c are excluded when CONFIG_RISCV_ALTERNATIVE_EARLY is set, this configuration is not universally enabled, leaving many RISC-V deployments vulnerable to this deadlock condition.

The fix addresses this by unconditionally excluding all sbi_ecall.c functions from function tracing, regardless of kernel configuration options. Since SBI ecalls can be effectively logged via dedicated trace events, excluding these functions from general function tracing does not significantly limit debugging capabilities.

Attack Vector

The vulnerability can be exploited locally by any user with write access to the ftrace control files in /sys/kernel/tracing/. An attacker can trigger the deadlock by writing a snapshot filter for the __sbi_ecall function:

The attack requires local access to the tracing interface, typically available to root or users with appropriate capabilities. Once the filter is set, the next SBI ecall (which occurs frequently due to timer interrupts on systems without SSTC) will trigger the infinite loop and system deadlock.

Detection Methods for CVE-2026-23217

Indicators of Compromise

System hangs or becomes completely unresponsive on RISC-V platforms
Kernel log entries showing ftrace snapshot operations on __sbi_ecall functions immediately before system freeze
Presence of suspicious entries in /sys/kernel/tracing/set_ftrace_filter referencing __sbi_ecall:snapshot
Unexpected modifications to ftrace configuration files by non-administrative users

Detection Strategies

Monitor access to /sys/kernel/tracing/set_ftrace_filter for suspicious write operations
Audit kernel configuration to verify CONFIG_RISCV_ALTERNATIVE_EARLY status on RISC-V systems
Implement file integrity monitoring on ftrace control interfaces
Review system logs for patterns indicating recursive snapshot triggers before system hangs

Monitoring Recommendations

Deploy endpoint detection solutions capable of monitoring kernel subsystem interactions
Configure audit rules for tracing-related file modifications in /sys/kernel/tracing/
Establish baseline ftrace configurations and alert on unauthorized changes
Monitor for sudden system hangs on RISC-V infrastructure that require hard reboots

How to Mitigate CVE-2026-23217

Immediate Actions Required

Apply the latest kernel patches that exclude sbi_ecall.c functions from tracing
Restrict access to /sys/kernel/tracing/ to only trusted administrative users
Enable CONFIG_RISCV_ALTERNATIVE_EARLY if possible in kernel configurations
Consider disabling ftrace on production RISC-V systems if not actively needed

Patch Information

The Linux kernel development team has released patches to address this vulnerability. The fix ensures that all sbi_ecall.c functions are unconditionally excluded from function tracing, preventing the recursive snapshot deadlock condition.

Patches are available through the following kernel git commits:

Organizations running RISC-V Linux systems should update to kernel versions containing these fixes as soon as possible.

Workarounds

Enable CONFIG_RISCV_ALTERNATIVE_EARLY in kernel configuration and rebuild the kernel
Manually remove any __sbi_ecall entries from ftrace filters by clearing /sys/kernel/tracing/set_ftrace_filter
Restrict write permissions on /sys/kernel/tracing/ directory to prevent unauthorized filter modifications
Use dedicated SBI trace events instead of function tracing for monitoring ecall activity

bash

# Clear existing ftrace filters on RISC-V systems
echo "" > /sys/kernel/tracing/set_ftrace_filter

# Restrict tracing directory access
chmod 700 /sys/kernel/tracing/
chown root:root /sys/kernel/tracing/

# Verify no sbi_ecall functions are being traced
grep sbi /sys/kernel/tracing/set_ftrace_filter