CVE-2026-64592: Linux Kernel RISC-V DoS Vulnerability

CVE-2026-64592 Overview

CVE-2026-64592 affects the Linux kernel's RISC-V memory management subsystem. The vulnerability resides in the spurious fault handling path where the Svvptc extension does not guarantee that returning from a fault handler is safe without first performing an sfence.vma operation. If the bounded timeframe for an accessed page to become valid has not elapsed after sret, the CPU can fault again and crash the system.

The fix unconditionally issues sfence.vma for spurious faults on RISC-V, trading a minor slowdown for stability. The flaw only impacts RISC-V systems running affected Linux kernel versions.

Critical Impact
A local workload triggering repeated page faults on RISC-V hardware can cause a kernel crash, resulting in denial of service on affected systems.

Affected Products

Linux kernel on RISC-V architecture with Svvptc extension support
Upstream Linux kernel versions prior to the referenced stable patches
Distributions shipping RISC-V kernels without the backported fix

Discovery Timeline

2026-08-06 - CVE-2026-64592 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-64592

Vulnerability Analysis

The defect lives in the RISC-V memory management code path that handles spurious page faults [CWE-noinfo]. On RISC-V, the Svvptc extension permits the hardware to make a recently updated page table entry visible within a bounded timeframe without requiring an explicit sfence.vma. The kernel's spurious fault handler assumed this bound would always elapse before the faulting instruction re-executed after sret.

That assumption is incorrect. After clearing the accessed-bit tracking state, the handler can return to userspace before the page table entry becomes architecturally visible. The instruction re-executes, faults a second time, and the kernel treats this as an unexpected condition, producing a crash.

The patch removes the conditional path and always emits sfence.vma on the spurious fault return path. This flushes the TLB entry and forces the CPU to re-walk the page tables, guaranteeing forward progress at the cost of an additional TLB operation on rare paths.

Root Cause

The root cause is an unsafe optimization that relied on the Svvptc timing guarantee to skip TLB invalidation on spurious faults. The bounded visibility window is not tight enough to eliminate a fault-return-fault loop, so skipping the sfence.vma leaves a window where the CPU can re-fault on the same address.

Attack Vector

Exploitation requires local execution on a RISC-V system running an affected kernel with the Svvptc extension enabled. A userspace process producing frequent memory accesses against pages whose translations are being updated by another thread can hit the race repeatedly. The observable outcome is a kernel oops or panic rather than privilege escalation or memory disclosure.

The vulnerability is described in the kernel commit messages referenced in the Kernel Patch Update and Kernel Stability Fix. No public proof-of-concept exists.

Detection Methods for CVE-2026-64592

Indicators of Compromise

Unexpected kernel oops or panic messages referencing handle_mm_fault or spurious fault paths on RISC-V hosts.
Repeated segmentation fault or bus error patterns from workloads performing concurrent page table updates.
System log entries showing sret followed by an immediate re-fault on the same virtual address.

Detection Strategies

Inventory RISC-V systems and correlate installed kernel versions against the fixed commits in the stable tree.
Monitor dmesg and journald for kernel fault backtraces originating in RISC-V memory management code.
Track crash telemetry from RISC-V workloads and flag reboots that follow spurious fault stack traces.

Monitoring Recommendations

Ingest kernel logs into a centralized logging platform and alert on Oops, BUG, or panic strings from RISC-V hosts.
Baseline crash frequency per host and investigate deviations, particularly on systems running multi-threaded database or virtualization workloads.
Track kernel version drift across the fleet so that unpatched RISC-V nodes are visible to operations teams.

How to Mitigate CVE-2026-64592

Immediate Actions Required

Apply the upstream stable kernel patches referenced in the NVD entry to all RISC-V systems.
Prioritize RISC-V hosts running the Svvptc extension, since these are the systems exposed to the fault-return-fault window.
Restart affected nodes after patching to load the corrected kernel image.

Patch Information

The fix is available in the Linux stable tree across multiple branches. See Kernel Patch Update, Kernel Commit Changes, Kernel Security Improvement, and Kernel Stability Fix. The change makes sfence.vma unconditional in the spurious fault return path.

Workarounds

No supported workaround exists at the source level short of patching; Svvptc is a hardware capability that cannot be trivially disabled from userspace.
Reduce exposure by limiting untrusted local workloads on unpatched RISC-V systems until kernels are updated.
Where feasible, run affected hosts on kernels that predate the introduction of the optimized spurious fault return path.

bash

# Verify running kernel and confirm patch presence on RISC-V hosts
uname -srm
grep -R "sfence.vma" /sys/kernel/debug/ 2>/dev/null || true
# Compare installed kernel commit against fixed stable IDs:
#   1b2c6b56a9fa 4d730cab96e6 c4df24702bfc ede985ff4b56