{"id":"CVE-2026-98464","published":"2026-10-18T16:16:56Z","modified":"2026-10-24T14:16:42Z","title":"In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during…","vendor":"Linux","product":"Linux","tier":"core","eol":null,"description":{"text":"In the Linux kernel, the following vulnerability has been resolved:\n\nRISC-V: KVM: Synchronize hrtimer callback during teardown\n\nThe non-Sstc hrtimer callback clears next_set before its final uses of\nthe enclosing vCPU.  If teardown observes next_set as false while the\ncallback is still running, kvm_riscv_vcpu_timer_cancel() skips\nhrtimer_cancel() and kvm_destroy_vcpus() can free the vCPU before the\ncallback enters kvm_riscv_vcpu_set_interrupt().\n\nA guest can arm the timer with SBI TIME and request shutdown with SBI\nlegacy shutdown or SRST.  A VMM that honors KVM_EXIT_SYSTEM_EVENT and\ndestroys the VM supplies the teardown side of the race; no post-launch\nhost ioctl is needed to arm or request teardown.\n\nOn upstream master 62cc90241548, generic KASAN reported:\n\n  BUG: KASAN: slab-use-after-free in do_raw_spin_lock\n  Write of size 4 at addr ff60000005e58898\n\n  kvm_riscv_vcpu_set_interrupt\n  kvm_riscv_vcpu_hrtimer_expired\n  __hrtimer_run_queues\n  hrtimer_interrupt\n\nThe object was allocated by KVM_CREATE_VCPU and freed concurrently by:\n\n  kvm_destroy_vcpus\n  kvm_arch_destroy_vm\n  kvm_destroy_vm\n  __fput\n\nFor deterministic validation, I added mdelay(1000) immediately after\nthe existing next_set = false assignment.  This only widens the\nexisting post-clear callback window.  A no-delay trace build naturally\nreached the callback-after-teardown-start/before-deinit ordering in 12\nof 200 runs, but 1,500 stock-kernel stress iterations did not produce a\nKASAN report, so natural reproduction is timing-sensitive.\n\nAlways invoke hrtimer_cancel() for an initialized timer.  Preserve the\nexisting -EINVAL result when the timer is no longer set, but only after\nsynchronizing with a running callback.\n\nWith this patch, hrtimer_cancel() blocked for the full widened callback\nwindow before vCPU destruction.  KASAN reported no error in 100\nfixed-and-widened runs or 200 fix-only timing-sweep runs.","provenance":"source","from":"NVD"},"summary":{"text":"The Linux kernel's RISC-V KVM timer code has a race in vCPU teardown: the non-Sstc hrtimer callback can still be running after teardown has decided no cancellation is needed, so the vCPU can be freed while the callback is still touching it. An attacker who can run a guest on the affected host can arm the timer through SBI TIME and request shutdown through SBI legacy shutdown or SRST, with a VMM that destroys the VM on the resulting system event supplying the teardown side, and no post-launch host ioctl is needed.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:25:27Z"},"cvss":{"score":9.3,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00143,"percentile":0.03595,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":4,"pulses":[{"name":"Known_Cve | Oct 27, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6adf68beabc3bad24a2b7cc6","created":"2026-10-26"},{"name":"Known_Cve | Oct 24, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6adb7414397c3ad4799aa4ce","created":"2026-10-23"},{"name":"Known_Cve | Oct 23, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ada237de8198eb6a6cbfac4","created":"2026-10-22"},{"name":"Known_Cve | Oct 22, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad8d34cb141a6cceeba88be","created":"2026-10-21"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://git.kernel.org/stable/c/2af03b606aadaaeb386658ef798c79bdcdef87c1","tags":[]},{"url":"https://git.kernel.org/stable/c/3cc6184bd5920c9685d87f4e260568feba08650d","tags":[]},{"url":"https://git.kernel.org/stable/c/9bdbae64ae0dab93041ebc57ec4e93def793fc2d","tags":[]},{"url":"https://git.kernel.org/stable/c/aaad136d56d91252517272b68cd533e5714698d5","tags":[]},{"url":"https://git.kernel.org/stable/c/e66aced74f0122380603c9910a71d77618b28f0e","tags":[]},{"url":"https://git.kernel.org/stable/c/ea91f05a55b807ead3166546a2c75f4185ca645f","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-103704","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-103704","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-18","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98464","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":8.8,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":0.72,"detail":"percentile 0.0360"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.59,"detail":"4 pulses"},{"name":"CVSS severity","points":6.51,"detail":"base score 9.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}