CVE-2026-98639: KVM: riscv: Fix NACL hfence entry update order
In the Linux kernel, the following vulnerability has been resolved:
KVM: riscv: Fix NACL hfence entry update order
The SBI v3.0 specification (section 15.1.2) requires a nested HFENCE entry to be populated as follows: 1) find an unused entry with Config.Pending == 0 2) update the PageNumber and PageCount words 3) update the Config word with Config.Pending set
kvmriscvnaclhfence() writes the Config word first, so the SBI implementation (or NACL hardware) can observe a pending entry with pnum/pcount values left over from the previous use of that entry, resulting in incorrect TLB flush ranges.
Write pnum and pcount first and the Config word last. Since the consumer is an external agent on coherent shared memory, use WRITEONCE() to stop the compiler from reordering the stores and smpwmb() to make the parameter words globally visible before the Pending bit is set.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update the NACL HFENCE entry in this order: find an unused entry with Config.Pending == 0, write the Page_Number and Page_Count words first, then set the Config word with Config.Pending set; use WRITE_ONCE() and an smp_wmb() so the parameter words are globally visible before the Config word.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects Linux kernel KVM on RISC-V where nested HFENCE entries are consumed by an SBI implementation or NACL hardware through coherent shared memory.
What is required for the incorrect TLB flush to occur?
An HFENCE entry must be reused such that its Config word is observed with the Pending bit set before the new Page_Number and Page_Count values are visible. The consumer can then use values left over from the entry's previous use and flush an incorrect TLB range.
What should be done if updates cannot be applied immediately?
The provided data does not specify a configuration workaround. Prioritize applying a kernel version containing the fix, which writes the page parameters before setting Config.Pending and enforces the required memory ordering.