CVE-2026-98639

A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for the RISC-V architecture. During nested virtualization acceleration, control flags are written before the target page parameters are properly committed to shared memory. Consequently, the supervisor interface or underlying hardware can process outdated parameters, resulting in incorrect flushes of the Translation Lookaside Buffer (TLB, a cache used to speed up memory address translation). A local user or guest virtual machine could exploit this behavior to cause memory corruption, expose stale memory data, or induce a denial of service (DoS).

The KVM RISC-V NACL HFENCE producer can set Config.Pending before updating Page_Number and Page_Count. The SBI implementation or NACL hardware may therefore consume stale range parameters and flush the wrong TLB entries while the intended translations remain active. A stale translation can potentially preserve access to a page after its mapping has changed, which creates a plausible confidentiality and integrity risk across a virtualization boundary and can also cause crashes or guest corruption. For the CVSS the PR:L value is used because an attacker needs controlled execution in a guest or nested virtualization context but does not need administrative privileges on the host. AC:H is used because successful triggering depends on the external consumer observing the entry during a narrow store ordering window. The issue is not directly network reachable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.