CVE-2026-99018

A flaw was found in the Linux kernel's RISC-V architecture support. When Shadow Call Stack (SCS), a security feature designed to protect function return addresses, is enabled, the kernel incorrectly validates whether an exception originated from userspace using a user-modifiable register. An unprivileged local attacker can exploit this flaw by manipulating the register before triggering an exception, tricking the kernel into skipping the reload of the protected stack pointer. This issue allows the attacker to corrupt memory and hijack kernel control flow, leading to arbitrary code execution and privilege escalation.

This flaw is rated as Important because a local unprivileged user can compromise kernel control-flow integrity to obtain elevated privileges instead of causing a standard system crash. Exploitation is strictly confined to RISC-V platforms built with Shadow Call Stack functionality enabled. Supported enterprise environments running on non-RISC-V architectures do not execute this architecture-specific exception code and are unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

--- CME Mitigation Guidance (2026-11-02) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to ensure the kernel gates shadow call stack reload operations strictly on hardware exception status rather than user-writable thread-pointer registers: upgrade to the fixed Openshift/Ose Rhel Coreos builds, which gate shadow call stack pointer reload on the hardware sstatus.SPP bit instead of the user-writable tp register, closing user thread-pointer register manipulation. Until patched, this is only a concern on Linux systems on RISC-V architecture with CONFIG_SHADOW_CALL_STACK enabled — Deployments running on non-RISC-V architectures are unaffected — so Restrict untrusted local account access and prevent unauthorized local code execution on RISC-V hosts where CONFIG_SHADOW_CALL_STACK is enabled. As a compensating measure, Enforce SELinux to constrain post-exploitation actions and lateral movement if kernel control flow is hijacked, Configure SELinux confined user mappings to limit local user domains and execution privileges, Deploy EDR agents to monitor and detect anomalous privilege escalation behaviors and execution patterns, Utilize Falco or eBPF runtime security to detect unexpected root process execution and privilege alterations, Enable runtime memory error detection such as KASAN or HWASan to catch out-of-bounds accesses caused by corrupted stack pointers, and Enable Supervisor Mode Access Prevention to block the kernel from accessing or writing to userspace memory addresses. These controls limit blast radius and contain exploitation, but they do not fix the underlying improper shadow call stack pointer reload defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)