CVE-2026-98464RISC-V: KVM: Synchronize hrtimer callback during teardown

Description

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during teardown The non-Sstc hrtimer callback clears next_set before its final uses of the enclosing vCPU. If teardown observes next_set as false while the callback is still running, kvm_riscv_vcpu_timer_cancel() skips hrtimer_cancel() and kvm_destroy_vcpus() can free the vCPU before the callback enters kvm_riscv_vcpu_set_interrupt(). A guest can arm the timer with SBI TIME and request shutdown with SBI legacy shutdown or SRST. A VMM that honors KVM_EXIT_SYSTEM_EVENT and destroys the VM supplies the teardown side of the race; no post-launch host ioctl is needed to arm or request teardown. On upstream master 62cc90241548, generic KASAN reported: BUG: KASAN: slab-use-after-free in do_raw_spin_lock Write of size 4 at addr ff60000005e58898 kvm_riscv_vcpu_set_interrupt kvm_riscv_vcpu_hrtimer_expired __hrtimer_run_queues hrtimer_interrupt The object was allocated by KVM_CREATE_VCPU and freed concurrently by: kvm_destroy_vcpus kvm_arch_destroy_vm kvm_destroy_vm __fput For deterministic validation, I added mdelay(1000) immediately after the existing next_set = false assignment. This only widens the existing post-clear callback window. A no-delay trace build naturally reached the callback-after-teardown-start/before-deinit ordering in 12 of 200 runs, but 1,500 stock-kernel stress iterations did not produce a KASAN report, so natural reproduction is timing-sensitive. Always invoke hrtimer_cancel() for an initialized timer. Preserve the existing -EINVAL result when the timer is no longer set, but only after synchronizing with a running callback. With this patch, hrtimer_cancel() blocked for the full widened callback window before vCPU destruction. KASAN reported no error in 100 fixed-and-widened runs or 200 fix-only timing-sweep runs.

Timeline

Scores

EPSS (exploitation in 30 days)

0.14% · top 96% of all CVEs (14 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.3.

Affected products

• Linux · Linux

  • affected 3a9f66cb25e18a3eeca36c08d9f823a35b3ddc22 – < 9bdbae64ae0dab93041ebc57ec4e93def793fc2d
  • affected 3a9f66cb25e18a3eeca36c08d9f823a35b3ddc22 – < 2af03b606aadaaeb386658ef798c79bdcdef87c1
  • affected 3a9f66cb25e18a3eeca36c08d9f823a35b3ddc22 – < e66aced74f0122380603c9910a71d77618b28f0e
  • affected 3a9f66cb25e18a3eeca36c08d9f823a35b3ddc22 – < ea91f05a55b807ead3166546a2c75f4185ca645f
  • affected 3a9f66cb25e18a3eeca36c08d9f823a35b3ddc22 – < 3cc6184bd5920c9685d87f4e260568feba08650d
  • affected 3a9f66cb25e18a3eeca36c08d9f823a35b3ddc22 – < aaad136d56d91252517272b68cd533e5714698d5

• Linux · Linux

  • affected 5.16
  • unaffected < 5.16
  • unaffected 6.1.189 – ≤ 6.1.*
  • unaffected 6.6.158 – ≤ 6.6.*
  • unaffected 6.12.112 – ≤ 6.12.*
  • unaffected 6.18.55 – ≤ 6.18.*
  • unaffected 7.2.9 – ≤ 7.2.*
  • unaffected 7.3 – ≤ *

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-103704 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-98464](https://cveledger.app/badge/CVE-2026-98464.svg)](https://cveledger.app/cve/CVE-2026-98464)

Record last updated 24 Oct 2026, 14:08 UTC.