---
id: CVE-2026-98465
title: 'RISC-V: KVM: Serialize IMSIC attributes with vCPU migration'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  RISC-V: KVM: Serialize IMSIC attributes with vCPU migration

  KVM device ioctls are not serialized against KVM_RUN. As a result,
  kvm_riscv_aia_imsic_rw_attr() can snapsh…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= db8b7e97d6137a28b2bfc07e591d54da268f0c36 <
    a29c5d2dd2ef9a8617a9a6d5585696d5f149cd98
  - >-
    Linux >= db8b7e97d6137a28b2bfc07e591d54da268f0c36 <
    c525772c304c971b0d3a1f2898dedbae653efe90
  - >-
    Linux >= db8b7e97d6137a28b2bfc07e591d54da268f0c36 <
    71acbea44e78665ea90e3c310fca6bbdcc0252db
  - >-
    Linux >= db8b7e97d6137a28b2bfc07e591d54da268f0c36 <
    8ae12ccaec6ec74945d8c1ef39f2c1b8df779abc
  - Linux 6.5
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:15:17.498Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98465'
references:
  - url: 'https://git.kernel.org/stable/c/a29c5d2dd2ef9a8617a9a6d5585696d5f149cd98'
  - url: 'https://git.kernel.org/stable/c/c525772c304c971b0d3a1f2898dedbae653efe90'
  - url: 'https://git.kernel.org/stable/c/71acbea44e78665ea90e3c310fca6bbdcc0252db'
  - url: 'https://git.kernel.org/stable/c/8ae12ccaec6ec74945d8c1ef39f2c1b8df779abc'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.300Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

RISC-V: KVM: Serialize IMSIC attributes with vCPU migration

KVM device ioctls are not serialized against KVM_RUN. As a result,
kvm_riscv_aia_imsic_rw_attr() can snapshot the physical CPU and HGEI of
an IMSIC VS-file before a concurrent vCPU migration releases it.

The HGEI can then be allocated to another vCPU before imsic_vsfile_rw()
uses the stale tuple. A GET or SET attribute may consequently access the
new owner's interrupt file.

Serialize the entire IMSIC attribute operation with the target vCPU
mutex. This prevents the VS-file from being migrated and recycled until
the attribute access completes. Acquire the mutex killably so that the
device ioctl remains interruptible while waiting for KVM_RUN to finish.

## Affected

- `Linux >= db8b7e97d6137a28b2bfc07e591d54da268f0c36 < a29c5d2dd2ef9a8617a9a6d5585696d5f149cd98`
- `Linux >= db8b7e97d6137a28b2bfc07e591d54da268f0c36 < c525772c304c971b0d3a1f2898dedbae653efe90`
- `Linux >= db8b7e97d6137a28b2bfc07e591d54da268f0c36 < 71acbea44e78665ea90e3c310fca6bbdcc0252db`
- `Linux >= db8b7e97d6137a28b2bfc07e591d54da268f0c36 < 8ae12ccaec6ec74945d8c1ef39f2c1b8df779abc`
- `Linux 6.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.