CVE-2026-99017: riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE
In the Linux kernel, the following vulnerability has been resolved:
riscv: errata: select RISCVALTERNATIVEEARLY for THEAD GHOSTWRITE
errataprobeghostwrite() only marks the CPU as vulnerable when it is called at the RISCVALTERNATIVESEARLYBOOT stage, and the mitigation in ghostwriteenablemitigation() only takes effect if the vulnerable state was recorded before the boot alternatives are patched.
The early boot stage is only executed when CONFIGRISCVALTERNATIVEEARLY is enabled, which currently is only selected by ERRATATHEADMAE. In a kernel built with ERRATATHEADGHOSTWRITE=y but ERRATATHEADMAE=n, the early alternatives never run, so ghostwritestate is never set to VULNERABLE: ghostwriteenablemitigation() returns false, xtheadvector remains enabled, and sysfs reports "Not affected" on a vulnerable T-Head C9xx CPU.
Select RISCVALTERNATIVEEARLY from ERRATATHEADGHOSTWRITE so that the vulnerability is detected in the early boot stage and the default mitigation is applied.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Select RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE so early boot alternatives run and the T-Head C9xx Ghostwrite mitigation is applied.
Linux kernel RISC-V errata configuration RISCV_ALTERNATIVE_EARLY = enabled when ERRATA_THEAD_GHOSTWRITE is enabled