CVE-2026-98465: Linux Kernel RISC-V KVM Privilege Escalation

CVE-2026-98465 Overview

CVE-2026-98465 is a race condition in the Linux kernel's RISC-V Kernel-based Virtual Machine (KVM) implementation. The flaw resides in the Incoming Message-Signaled Interrupt Controller (IMSIC) attribute handling for guest vCPUs. KVM device ioctls are not serialized against KVM_RUN, allowing kvm_riscv_aia_imsic_rw_attr() to snapshot the physical CPU and Hypervisor Guest External Interrupt (HGEI) of an IMSIC VS-file before a concurrent vCPU migration releases it. A GET or SET attribute operation can then access another vCPU's interrupt file. The upstream fix serializes the IMSIC attribute operation using the target vCPU mutex, acquired killably to keep the device ioctl interruptible.

Critical Impact
Concurrent KVM ioctls can access the wrong guest's interrupt file, enabling cross-vCPU interrupt state corruption or information disclosure on RISC-V hypervisors.

Affected Products

Linux kernel RISC-V KVM subsystem (IMSIC attribute handling)
Distributions shipping affected RISC-V KVM builds prior to the referenced stable commits
Virtualization hosts running RISC-V guests with the Advanced Interrupt Architecture (AIA) IMSIC

Discovery Timeline

2026-10-18 - CVE-2026-98465 published to the National Vulnerability Database (NVD)
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98465

Vulnerability Analysis

The vulnerability is a Time-of-Check Time-of-Use (TOCTOU) race condition in the RISC-V KVM IMSIC code path. The function kvm_riscv_aia_imsic_rw_attr() reads the physical CPU and HGEI tuple that identifies the IMSIC VS-file assigned to a guest vCPU. Because KVM device ioctls run without holding the target vCPU mutex, a KVM_RUN thread can migrate the vCPU and release the VS-file after the snapshot is taken. The HGEI may then be reallocated to a different vCPU before imsic_vsfile_rw() performs its memory access.

The result is that an attribute GET or SET operation issued against one vCPU can read or write the IMSIC state of a different vCPU that now owns the recycled HGEI. This produces inconsistent interrupt delivery state and potential disclosure of interrupt data belonging to another guest context.

Root Cause

The root cause is missing synchronization between the device-ioctl path handling IMSIC attributes and the vCPU execution path performing migration. The code captured HGEI and physical CPU identifiers outside of any lock protecting vCPU lifetime, violating the invariant that a VS-file must remain pinned to the originally targeted vCPU for the duration of the attribute operation.

Attack Vector

Exploitation requires local access to issue KVM ioctls on a host with RISC-V AIA IMSIC virtualization. A user with permission to manage a VM can trigger concurrent KVM_RUN and IMSIC attribute ioctls across vCPUs to force the race window. The impact is confined to processes authorized to interact with /dev/kvm, typically the Virtual Machine Monitor (VMM) process such as QEMU.

No public proof-of-concept is listed in the enriched data. See the upstream fix commits for the exact code path: Kernel.org Commit 6c2bcf6, Kernel.org Commit 71acbea, and Kernel.org Commit c525772.

Detection Methods for CVE-2026-98465

Indicators of Compromise

Unexpected interrupt delivery anomalies or lost interrupts reported by RISC-V guests sharing a host
Kernel log entries referencing IMSIC VS-file inconsistencies or HGEI reallocation errors
VMM processes issuing high-frequency KVM_SET_DEVICE_ATTR or KVM_GET_DEVICE_ATTR ioctls concurrently with KVM_RUN

Detection Strategies

Audit running kernel versions on RISC-V hosts and compare against the stable commits listed in the advisory
Monitor host syscall telemetry for unusual patterns of KVM device-attribute ioctls targeting IMSIC across vCPUs
Review guest interrupt handling logs for symptoms consistent with cross-vCPU interrupt state corruption

Monitoring Recommendations

Enable kernel audit rules on /dev/kvm access and correlate with VMM process identifiers
Track kernel version inventory for RISC-V hypervisor hosts and alert on unpatched builds
Collect dmesg and KVM tracepoints into a central data lake for retrospective analysis of IMSIC-related warnings

How to Mitigate CVE-2026-98465

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the kernel.org stable commits for all affected RISC-V hosts
Restrict /dev/kvm access to trusted VMM service accounts only
Reduce exposure by limiting the number of untrusted tenants running on affected RISC-V hypervisors until patched

Patch Information

The fix serializes the entire IMSIC attribute operation with the target vCPU mutex, preventing migration and HGEI recycling during attribute access. The mutex is acquired killably so the device ioctl remains interruptible while waiting for KVM_RUN to complete. Patches are available in the following stable commits: 6c2bcf6, 71acbea, 8ae12cc, a29c5d2, and c525772.

Workarounds

No official workaround exists; patching is the only reliable remediation
Avoid concurrent IMSIC attribute ioctls and KVM_RUN from VMM code where feasible
Consider disabling RISC-V AIA IMSIC guest configurations on unpatched hosts if operationally acceptable

bash

# Verify running kernel version on RISC-V host
uname -r

# Example: check whether the stable fix commit is present in the running source tree
git -C /usr/src/linux log --oneline | grep -E '6c2bcf6|71acbea|8ae12cc|a29c5d2|c525772'