UBUNTU-CVE-2026-98639: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: KVM: riscv: Fix NACL hfence entry update order The SBI v3.0 specification (section 15.1.2) requires a nested HFENCE entry to be populated as follows: 1) find an unused entry with Config.Pending == 0 2) update the PageNumber and PageCount words 3) update the Config word with Config.Pending set kvmriscvnaclhfence() writes the Config word first, so the SBI implementation (or NACL hardware) can observe a pending entry with pnum/pcount values left over from the previous use of that entry, resulting in incorrect TLB flush ranges. Write pnum and pcount first and the Config word last. Since the consumer is an external agent on coherent shared memory, use WRITEONCE() to stop the compiler from reordering the stores and smpwmb() to make the parameter words globally visible before the Pending bit is set.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update __kvm_riscv_nacl_hfence() to write the pnum and pcount words first, use WRITE_ONCE() to prevent compiler store reordering, issue smp_wmb() so the parameter words are globally visible, and write the Config word with Config.Pending set last.