CVE-2026-98465: RISC-V: KVM: Serialize IMSIC attributes with vCPU migration
In the Linux kernel, the following vulnerability has been resolved:
RISC-V: KVM: Serialize IMSIC attributes with vCPU migration
KVM device ioctls are not serialized against KVMRUN. As a result, kvmriscvaiaimsicrwattr() can snapshot the physical CPU and HGEI of an IMSIC VS-file before a concurrent vCPU migration releases it.
The HGEI can then be allocated to another vCPU before imsicvsfilerw() uses the stale tuple. A GET or SET attribute may consequently access the new owner's interrupt file.
Serialize the entire IMSIC attribute operation with the target vCPU mutex. This prevents the VS-file from being migrated and recycled until the attribute access completes. Acquire the mutex killably so that the device ioctl remains interruptible while waiting for KVMRUN to finish.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Serialize the entire RISC-V KVM IMSIC attribute operation with the target vCPU mutex, acquiring the mutex killably so the device ioctl remains interruptible while waiting for KVM_RUN to finish and preventing VS-file migration or recycling during attribute access.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using RISC-V KVM with AIA IMSIC support are exposed when IMSIC device attribute GET or SET ioctls can run concurrently with vCPU migration.
What must occur for exploitation or incorrect access?
A KVM device ioctl must snapshot an IMSIC VS-file's physical CPU and HGEI, while a concurrent vCPU migration releases that file and its HGEI is then allocated to another vCPU before the attribute operation uses the saved values.
What is the impact of the race?
The IMSIC attribute GET or SET operation can access the interrupt file belonging to a different vCPU, the new owner of the recycled HGEI.
What does the fix change?
The fix holds the target vCPU mutex for the entire IMSIC attribute operation, preventing VS-file migration and HGEI reuse until access completes. The mutex is acquired killably, so the ioctl remains interruptible while waiting for KVM_RUN to finish.