CVE-2026-99017

A flaw was found in the Linux kernel. Under specific configurations on RISC-V systems using T-Head processors, the kernel does not execute early boot checks required to identify hardware errata. As a result, the default mitigation for the Ghostwrite hardware vulnerability is not applied, which may allow a local attacker to exploit unmitigated CPU flaws to access unauthorized data or compromise system integrity.

This vulnerability is rated as Moderate impact because exploitation requires local access on specific hardware architectures and depends on an uncommon kernel compile-time configuration. Standard Red Hat Enterprise Linux distributions do not support or distribute kernels for the RISC-V architecture, meaning Red Hat environments are not directly affected by this flaw. On platforms where applicable, bypassing early processor errata discovery prevents runtime mitigation of the Ghostwrite issue, leaving unprivileged local processes capable of corrupting system memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

--- CME Mitigation Guidance (2026-11-02) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to enable early boot alternatives probing by ensuring CONFIG_RISCV_ALTERNATIVE_EARLY is active in kernel builds supporting T-Head Ghostwrite errata mitigations: upgrade to the fixed Kernel/Kernel Ivos Qualcomm builds, which select RISCV_ALTERNATIVE_EARLY automatically when ERRATA_THEAD_GHOSTWRITE is enabled in Kconfig, closing execution of xtheadvector instruction sequences by an unprivileged local user. Until patched, this is only a concern on RISC-V systems utilizing vulnerable T-Head C9xx processors running kernels configured with CONFIG_ERRATA_THEAD_GHOSTWRITE=y and CONFIG_ERRATA_THEAD_MAE=n — Non-RISC-V architectures and standard Red Hat Enterprise Linux distributions that do not support RISC-V are unaffected — so Restrict untrusted local user access and execution on affected RISC-V hosts, or recompile the kernel with CONFIG_ERRATA_THEAD_MAE=y so early alternatives execute. As a compensating measure, Deploy SELinux in enforcing mode to confine compromised processes to their domain if Ghostwrite memory corruption occurs and Map unprivileged local user sessions to confined SELinux domains to restrict post-exploitation access following hardware memory manipulation. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing early boot errata selection defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)