{"id":"CVE-2026-98465","title":"RISC-V: KVM: Serialize IMSIC attributes with vCPU migration","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nRISC-V: KVM: Serialize IMSIC attributes with vCPU migration\n\nKVM device ioctls are not serialized against KVM_RUN. As a result,\nkvm_riscv_aia_imsic_rw_attr() can snapsh…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= db8b7e97d6137a28b2bfc07e591d54da268f0c36 < a29c5d2dd2ef9a8617a9a6d5585696d5f149cd98","Linux >= db8b7e97d6137a28b2bfc07e591d54da268f0c36 < c525772c304c971b0d3a1f2898dedbae653efe90","Linux >= db8b7e97d6137a28b2bfc07e591d54da268f0c36 < 71acbea44e78665ea90e3c310fca6bbdcc0252db","Linux >= db8b7e97d6137a28b2bfc07e591d54da268f0c36 < 8ae12ccaec6ec74945d8c1ef39f2c1b8df779abc","Linux 6.5"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T15:15:17.498Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98465","references":[{"url":"https://git.kernel.org/stable/c/a29c5d2dd2ef9a8617a9a6d5585696d5f149cd98"},{"url":"https://git.kernel.org/stable/c/c525772c304c971b0d3a1f2898dedbae653efe90"},{"url":"https://git.kernel.org/stable/c/71acbea44e78665ea90e3c310fca6bbdcc0252db"},{"url":"https://git.kernel.org/stable/c/8ae12ccaec6ec74945d8c1ef39f2c1b8df779abc"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T15:45:12.300Z","slug":"CVE-2026-98465","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRISC-V: KVM: Serialize IMSIC attributes with vCPU migration\n\nKVM device ioctls are not serialized against KVM_RUN. As a result,\nkvm_riscv_aia_imsic_rw_attr() can snapshot the physical CPU and HGEI of\nan IMSIC VS-file before a concurrent vCPU migration releases it.\n\nThe HGEI can then be allocated to another vCPU before imsic_vsfile_rw()\nuses the stale tuple. A GET or SET attribute may consequently access the\nnew owner's interrupt file.\n\nSerialize the entire IMSIC attribute operation with the target vCPU\nmutex. This prevents the VS-file from being migrated and recycled until\nthe attribute access completes. Acquire the mutex killably so that the\ndevice ioctl remains interruptible while waiting for KVM_RUN to finish.\n\n## Affected\n\n- `Linux >= db8b7e97d6137a28b2bfc07e591d54da268f0c36 < a29c5d2dd2ef9a8617a9a6d5585696d5f149cd98`\n- `Linux >= db8b7e97d6137a28b2bfc07e591d54da268f0c36 < c525772c304c971b0d3a1f2898dedbae653efe90`\n- `Linux >= db8b7e97d6137a28b2bfc07e591d54da268f0c36 < 71acbea44e78665ea90e3c310fca6bbdcc0252db`\n- `Linux >= db8b7e97d6137a28b2bfc07e591d54da268f0c36 < 8ae12ccaec6ec74945d8c1ef39f2c1b8df779abc`\n- `Linux 6.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}