CVE-2026-80688

A flaw was found in the Linux kernel, specifically within the RISC-V architecture's vec_check_unaligned_access_speed_all_cpus function. This function, intended for initialization, could continue running as a kernel thread after its allocated memory is released. If this occurs, the system attempts to access freed memory, leading to an instruction page fault and a kernel crash. This vulnerability could result in a Denial of Service (DoS) condition.

A low impact flaw was found in the Linux kernel's RISC-V unaligned access speed probing code. The vec_check_unaligned_access_speed_all_cpus() function in arch/riscv/kernel/unaligned_access_speed.c was annotated __init, but it runs in a kernel thread that does not necessarily finish before the system completes boot and free_initmem() unmaps the .init.text section. Because this function performs SBI calls to probe unaligned access speed, and those calls can be slow (for example when debug prints are added to SBI), the kthread can still be running when init memory is freed and take an instruction page fault when fetching instructions from the freed region, causing a kernel Oops and crash and resulting in a denial of service. This issue is limited to the RISC-V architecture and manifests as a boot-time race; it does not impact confidentiality or integrity. All Red Hat Enterprise Linux (kernel and kernel-rt) and Red Hat In-Vehicle OS (kernel and kernel-ivos-qualcomm) streams are marked NOTAFFECTED because the vulnerable code is not present in the shipped kernel builds.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.