{"api_version":"1","generated_at":"2026-10-21T08:02:59+00:00","cve":"CVE-2026-98639","urls":{"html":"https://cve.report/CVE-2026-98639","api":"https://cve.report/api/cve/CVE-2026-98639.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-98639","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-98639"},"summary":{"title":"KVM: riscv: Fix NACL hfence entry update order","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: riscv: Fix NACL hfence entry update order\n\nThe SBI v3.0 specification (section 15.1.2) requires a nested HFENCE\nentry to be populated as follows:\n1) find an unused entry with Config.Pending == 0\n2) update the Page_Number and Page_Count words\n3) update the Config word with Config.Pending set\n\n__kvm_riscv_nacl_hfence() writes the Config word first, so the SBI\nimplementation (or NACL hardware) can observe a pending entry with\npnum/pcount values left over from the previous use of that entry,\nresulting in incorrect TLB flush ranges.\n\nWrite pnum and pcount first and the Config word last. Since the\nconsumer is an external agent on coherent shared memory, use\nWRITE_ONCE() to stop the compiler from reordering the stores and\nsmp_wmb() to make the parameter words globally visible before the\nPending bit is set.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-10-18 16:17:17","updated_at":"2026-10-19 10:19:28"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/6da466502621381fa88a6684290923d25c559266","name":"https://git.kernel.org/stable/c/6da466502621381fa88a6684290923d25c559266","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b3d346838ec65fac7fd83f5dbcedd13cadfffddb","name":"https://git.kernel.org/stable/c/b3d346838ec65fac7fd83f5dbcedd13cadfffddb","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/d6de766d8d26d71b714f548192099112def50a9c","name":"https://git.kernel.org/stable/c/d6de766d8d26d71b714f548192099112def50a9c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98639","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98639","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected d466c19cead5904d4d5d92adb2b213b411d3b849 d6de766d8d26d71b714f548192099112def50a9c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected d466c19cead5904d4d5d92adb2b213b411d3b849 6da466502621381fa88a6684290923d25c559266 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected d466c19cead5904d4d5d92adb2b213b411d3b849 b3d346838ec65fac7fd83f5dbcedd13cadfffddb git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.13","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.13 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.55 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.9 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/riscv/kvm/nacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"d6de766d8d26d71b714f548192099112def50a9c","status":"affected","version":"d466c19cead5904d4d5d92adb2b213b411d3b849","versionType":"git"},{"lessThan":"6da466502621381fa88a6684290923d25c559266","status":"affected","version":"d466c19cead5904d4d5d92adb2b213b411d3b849","versionType":"git"},{"lessThan":"b3d346838ec65fac7fd83f5dbcedd13cadfffddb","status":"affected","version":"d466c19cead5904d4d5d92adb2b213b411d3b849","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/riscv/kvm/nacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.13"},{"lessThan":"6.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.55","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.9","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.55","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.9","versionStartIncluding":"6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3","versionStartIncluding":"6.13","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: riscv: Fix NACL hfence entry update order\n\nThe SBI v3.0 specification (section 15.1.2) requires a nested HFENCE\nentry to be populated as follows:\n1) find an unused entry with Config.Pending == 0\n2) update the Page_Number and Page_Count words\n3) update the Config word with Config.Pending set\n\n__kvm_riscv_nacl_hfence() writes the Config word first, so the SBI\nimplementation (or NACL hardware) can observe a pending entry with\npnum/pcount values left over from the previous use of that entry,\nresulting in incorrect TLB flush ranges.\n\nWrite pnum and pcount first and the Config word last. Since the\nconsumer is an external agent on coherent shared memory, use\nWRITE_ONCE() to stop the compiler from reordering the stores and\nsmp_wmb() to make the parameter words globally visible before the\nPending bit is set."}],"providerMetadata":{"dateUpdated":"2026-10-19T09:23:09.004Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/d6de766d8d26d71b714f548192099112def50a9c"},{"url":"https://git.kernel.org/stable/c/6da466502621381fa88a6684290923d25c559266"},{"url":"https://git.kernel.org/stable/c/b3d346838ec65fac7fd83f5dbcedd13cadfffddb"}],"title":"KVM: riscv: Fix NACL hfence entry update order","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-98639","datePublished":"2026-10-18T15:20:10.591Z","dateReserved":"2026-09-25T10:25:14.361Z","dateUpdated":"2026-10-19T09:23:09.004Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-18 16:17:17","lastModifiedDate":"2026-10-19 10:19:28","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"98639","Ordinal":"1","Title":"KVM: riscv: Fix NACL hfence entry update order","CVE":"CVE-2026-98639","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"98639","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: riscv: Fix NACL hfence entry update order\n\nThe SBI v3.0 specification (section 15.1.2) requires a nested HFENCE\nentry to be populated as follows:\n1) find an unused entry with Config.Pending == 0\n2) update the Page_Number and Page_Count words\n3) update the Config word with Config.Pending set\n\n__kvm_riscv_nacl_hfence() writes the Config word first, so the SBI\nimplementation (or NACL hardware) can observe a pending entry with\npnum/pcount values left over from the previous use of that entry,\nresulting in incorrect TLB flush ranges.\n\nWrite pnum and pcount first and the Config word last. Since the\nconsumer is an external agent on coherent shared memory, use\nWRITE_ONCE() to stop the compiler from reordering the stores and\nsmp_wmb() to make the parameter words globally visible before the\nPending bit is set.","Type":"Description","Title":"KVM: riscv: Fix NACL hfence entry update order"}]}}}