CVE-2026-98639
Description
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for the RISC-V architecture. During nested virtualization acceleration, control flags are written before the target page parameters are properly committed to shared memory. Consequently, the supervisor interface or underlying hardware can process outdated parameters, resulting in incorrect flushes of the Translation Lookaside Buffer (TLB, a cache used to speed up memory address translation). A local user or guest virtual machine could exploit this behavior to cause memory corruption, expose stale memory data, or induce a denial of service (DoS).
Statement
The KVM RISC-V NACL HFENCE producer can set Config.Pending before updating Page_Number and Page_Count. The SBI implementation or NACL hardware may therefore consume stale range parameters and flush the wrong TLB entries while the intended translations remain active. A stale translation can potentially preserve access to a page after its mapping has changed, which creates a plausible confidentiality and integrity risk across a virtualization boundary and can also cause crashes or guest corruption. For the CVSS the PR:L value is used because an attacker needs controlled execution in a guest or nested virtualization context but does not need administrative privileges on the host. AC:H is used because successful triggering depends on the external consumer observing the entry during a narrow store ordering window. The issue is not directly network reachable.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.8 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | Low | N/A | N/A |
| Integrity Impact | Low | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
