---
id: CVE-2026-99017
title: 'riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE

  errata_probe_ghostwrite() only marks the CPU as vulnerable when it is
  called at the RISCV_ALTERNATIV…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4bf97069239bcfca9840936313c7ac35a6e04488 <
    fa465a7819ecbe5801b78c088d3cadaf2664b8ca
  - >-
    Linux >= 4bf97069239bcfca9840936313c7ac35a6e04488 <
    7fee577a2fa78b9a76da015beec1ccf978746ebb
  - >-
    Linux >= 4bf97069239bcfca9840936313c7ac35a6e04488 <
    298510bbc7c3017c0faf481c6ea66f1065b657b4
  - Linux 6.14
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:20:53.518Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99017'
references:
  - url: 'https://git.kernel.org/stable/c/fa465a7819ecbe5801b78c088d3cadaf2664b8ca'
  - url: 'https://git.kernel.org/stable/c/7fee577a2fa78b9a76da015beec1ccf978746ebb'
  - url: 'https://git.kernel.org/stable/c/298510bbc7c3017c0faf481c6ea66f1065b657b4'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.537Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE

errata_probe_ghostwrite() only marks the CPU as vulnerable when it is
called at the RISCV_ALTERNATIVES_EARLY_BOOT stage, and the mitigation
in ghostwrite_enable_mitigation() only takes effect if the vulnerable
state was recorded before the boot alternatives are patched.

The early boot stage is only executed when CONFIG_RISCV_ALTERNATIVE_EARLY
is enabled, which currently is only selected by ERRATA_THEAD_MAE. In a
kernel built with ERRATA_THEAD_GHOSTWRITE=y but ERRATA_THEAD_MAE=n, the
early alternatives never run, so ghostwrite_state is never set to
VULNERABLE: ghostwrite_enable_mitigation() returns false, xtheadvector
remains enabled, and sysfs reports "Not affected" on a vulnerable
T-Head C9xx CPU.

Select RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE so that the
vulnerability is detected in the early boot stage and the default
mitigation is applied.

## Affected

- `Linux >= 4bf97069239bcfca9840936313c7ac35a6e04488 < fa465a7819ecbe5801b78c088d3cadaf2664b8ca`
- `Linux >= 4bf97069239bcfca9840936313c7ac35a6e04488 < 7fee577a2fa78b9a76da015beec1ccf978746ebb`
- `Linux >= 4bf97069239bcfca9840936313c7ac35a6e04488 < 298510bbc7c3017c0faf481c6ea66f1065b657b4`
- `Linux 6.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.