CVE-2026-99016

A flaw was found in the Linux kernel's RISC-V architecture implementation. When the tagged address Application Binary Interface (ABI) is enabled, the kernel's fast user-space locking mechanism (futex) verifies an address after stripping its tag, but executes atomic memory operations using the original, tagged address. A local unprivileged attacker could exploit this flaw to perform unauthorized read and write operations on arbitrary kernel memory. This vulnerability can lead to local privilege escalation or complete system compromise.

Red Hat has assessed this issue as having an Important security impact because a local unprivileged user could obtain arbitrary kernel read and write primitives, leading to complete privilege escalation. However, this flaw is restricted to the RISC-V architecture when the tagged address ABI feature is configured. Supported Red Hat Enterprise Linux versions and enterprise product kernels do not incorporate this affected RISC-V implementation, and are therefore not vulnerable.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.