CVE-2026-98464

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RISC-V: KVM: Synchronize hrtimer callback during teardown

The non-Sstc hrtimer callback clears next_set before its final uses of

the enclosing vCPU. If teardown observes next_set as false while the

callback is still running, kvm_riscv_vcpu_timer_cancel() skips

hrtimer_cancel() and kvm_destroy_vcpus() can free the vCPU before the

callback enters kvm_riscv_vcpu_set_interrupt().

A guest can arm the timer with SBI TIME and request shutdown with SBI

legacy shutdown or SRST. A VMM that honors KVM_EXIT_SYSTEM_EVENT and

destroys the VM supplies the teardown side of the race; no post-launch

host ioctl is needed to arm or request teardown.

On upstream master 62cc90241548, generic KASAN reported:

BUG: KASAN: slab-use-after-free in do_raw_spin_lock

Write of size 4 at addr ff60000005e58898

kvm_riscv_vcpu_set_interrupt

kvm_riscv_vcpu_hrtimer_expired

__hrtimer_run_queues

hrtimer_interrupt

The object was allocated

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References