Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-98464— RISC-V: KVM: Synchronize hrtimer callback during teardown

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： RISC-V: KVM: 在销毁过程中同步 hrtimer 回调 在非 Sstic 模式下，hrtimer 回调函数会在其最后使用所属 vCPU 之前将 标志清除。如果在回调仍在运行时，销毁流程观察到 为 false，那么 将跳过 调用，导致 可能在回调进入 之前就释放了该 vCPU。 客户机（Guest）可以通过 SBI TIME 指令设置定时器，并通过 SBI 传统关机指令或 SRST 请求关机。任何支持 并在退出时销毁虚拟机（VM）的虚拟机监控程序（VMM）都会提

CVSS 9.3 · Critical EPSS 0.14% · P4

Affected Version Matrix 14

VendorProduct Version RangeStatus
Linux Linux 3a9f66cb25e18a3eeca36c08d9f823a35b3ddc22< 9bdbae64ae0dab93041ebc57ec4e93def793fc2d affected
3a9f66cb25e18a3eeca36c08d9f823a35b3ddc22< 2af03b606aadaaeb386658ef798c79bdcdef87c1 affected
3a9f66cb25e18a3eeca36c08d9f823a35b3ddc22< e66aced74f0122380603c9910a71d77618b28f0e affected
3a9f66cb25e18a3eeca36c08d9f823a35b3ddc22< ea91f05a55b807ead3166546a2c75f4185ca645f affected
3a9f66cb25e18a3eeca36c08d9f823a35b3ddc22< 3cc6184bd5920c9685d87f4e260568feba08650d affected
3a9f66cb25e18a3eeca36c08d9f823a35b3ddc22< aaad136d56d91252517272b68cd533e5714698d5 affected
5.16 affected
< 5.16 unaffected
… +6 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-98464

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
RISC-V: KVM: Synchronize hrtimer callback during teardown
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during teardown The non-Sstc hrtimer callback clears next_set before its final uses of the enclosing vCPU. If teardown observes next_set as false while the callback is still running, kvm_riscv_vcpu_timer_cancel() skips hrtimer_cancel() and kvm_destroy_vcpus() can free the vCPU before the callback enters kvm_riscv_vcpu_set_interrupt(). A guest can arm the timer with SBI TIME and request shutdown with SBI legacy shutdown or SRST. A VMM that honors KVM_EXIT_SYSTEM_EVENT and destroys the VM supplies the teardown side of the race; no post-launch host ioctl is needed to arm or request teardown. On upstream master 62cc90241548, generic KASAN reported: BUG: KASAN: slab-use-after-free in do_raw_spin_lock Write of size 4 at addr ff60000005e58898 kvm_riscv_vcpu_set_interrupt kvm_riscv_vcpu_hrtimer_expired __hrtimer_run_queues hrtimer_interrupt The object was allocated by KVM_CREATE_VCPU and freed concurrently by: kvm_destroy_vcpus kvm_arch_destroy_vm kvm_destroy_vm __fput For deterministic validation, I added mdelay(1000) immediately after the existing next_set = false assignment. This only widens the existing post-clear callback window. A no-delay trace build naturally reached the callback-after-teardown-start/before-deinit ordering in 12 of 200 runs, but 1,500 stock-kernel stress iterations did not produce a KASAN report, so natural reproduction is timing-sensitive. Always invoke hrtimer_cancel() for an initialized timer. Preserve the existing -EINVAL result when the timer is no longer set, but only after synchronizing with a running callback. With this patch, hrtimer_cancel() blocked for the full widened callback window before vCPU destruction. KASAN reported no error in 100 fixed-and-widened runs or 200 fix-only timing-sweep runs.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 3a9f66cb25e18a3eeca36c08d9f823a35b3ddc22 ~ 9bdbae64ae0dab93041ebc57ec4e93def793fc2d -
Linux Linux 5.16 -

II. Public POCs for CVE-2026-98464

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-98464

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-98464 (5)

Same Patch Batch · Linux · 2026-10-18 · 435 CVEs total

CVE-2026-98490 9.8 CRITICAL net: openvswitch: conntrack: fix helper UAF due to extensions realloc
CVE-2026-98548 9.8 CRITICAL sctp: discard the rest of the packet on a stale-cookie error
CVE-2026-98549 9.1 CRITICAL tcp: prevent collapsing skbs across boundary in rtx queue
CVE-2026-98451 8.8 HIGH smb: client: use finish_no_open() for non-regular inodes
CVE-2026-98466 8.2 HIGH KVM: arm64: Transfer the hyp stack pages out of the host stage-2
CVE-2026-98499 8.1 HIGH HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
CVE-2026-98454 8.1 HIGH smb: client: fix create context out-of-bounds reads
CVE-2026-98532 8.1 HIGH ipv6: do not let ipv6_find_hdr() return an offset past the packet end
CVE-2026-98507 7.8 HIGH mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish
CVE-2026-98487 7.8 HIGH net: bridge: mdb: restart port group walk after deletion
CVE-2026-98520 7.8 HIGH drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping
CVE-2026-98517 7.8 HIGH drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM
CVE-2026-98515 7.8 HIGH drm/nouveau: fix double-free in nvif_vmm_dtor
CVE-2026-98491 7.8 HIGH net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
CVE-2026-98436 7.8 HIGH accel/amdxdna: Disable device buffer exporting
CVE-2026-98510 7.8 HIGH drm/xe/vm: nuke PTs only after unlinking contested VMAs
CVE-2026-98524 7.8 HIGH rds: ib: Clear the sg list when mapping an MR fails
CVE-2026-98443 7.8 HIGH xfs: fix cursor and pointer handling when recovering iunlink buckets
CVE-2026-98442 7.8 HIGH net/sched: act_ct: fix helper UAF due to extensions realloc
CVE-2026-98441 7.8 HIGH net/sched: act_ct: avoid modifying shared unconfirmed ct entry

Showing top 20 of 435 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux