CVE-2026-98464

What the bug is

The non-Sstc hrtimer callback clears next_set before its final uses of the enclosing vCPU. If teardown observes next_set as false while the callback is still running, kvm_riscv_vcpu_timer_cancel() skips hrtimer_cancel() and kvm_destroy_vcpus() can free the vCPU before the callback enters kvm_riscv_vcpu_set_interrupt(). A guest can arm the timer with SBI TIME and request shutdown with SBI legacy shutdown or SRST. A VMM that honors KVM_EXIT_SYSTEM_EVENT and destroys the VM supplies the teardown side of the race; no post-launch host ioctl is needed to arm or request teardown. On upstream master 62cc90241548, generic KASAN reported: BUG: KASAN: slab-use-after-free in do_raw_spin_lock Write of size 4 at addr ff60000005e58898 kvm_riscv_vcpu_set_interrupt kvm_riscv_vcpu_hrtimer_expired __hrtimer_run_queues hrtimer_interrupt The object was allocated by KVM_CREATE_VCPU and freed concurrently by: kvm_destroy_vcpus kvm_arch_destroy_vm kvm_destroy_vm __fput For deterministic validation, I added mdelay(1000) immediately after the existing next_set = false assignment. This only widens the existing post-clear callback window. A no-delay trace build naturally reached the callback-after-teardown-start/before-deinit ordering in 12 of 200 runs, but 1,500 stock-kernel stress iterations did not produce a KASAN report, so natural reproduction is timing-sensitive. Always invoke hrtimer_cancel() for an initialized timer. Preserve the existing -EINVAL result when the timer is no longer set, but only after synchronizing with a running callback. With this patch, hrtimer_cancel() blocked for the full widened callback window before vCPU destruction. KASAN reported no error in 100 fixed-and-widened runs or 200 fix-only timing-sweep runs.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

arch/riscv/kvm/vcpu_timer.c

What this is

KERNEL VIRTUAL MACHINE FOR RISC-V (KVM/riscv)MAINTAINERS section matched on arch/riscv/kvm/ · kvm@vger.kernel.org · Maintained

Kernel module

kvm

Check it on the machine

grep -w CONFIG_KVM /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w kvm

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.

• bookwormBnot built on arm64/rt/arm64, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp
• trixieBnot built on armel/rpi, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp
• forky, sidBnot built on armhf/armmp, armhf/armmp-lpae

B

built in on some, a module on others, absent on the rest

Build switch

CONFIG_KVM

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Signals

Published

2026-10-18 (today)source

CVSS

no vector published, unrated

Attack vector

not published

EPSS

not scored

CISA KEV

not listedthe KEV catalogue

Debian urgency

not yet assignedsource

Subsystem

arch/riscv

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
5.16	6.1.189	9bdbae64ae0d
5.16	6.6.158	2af03b606aad
5.16	6.12.112	e66aced74f01
5.16	6.18.55	ea91f05a55b8
5.16	7.2.9	3cc6184bd592
5.16	7.3	aaad136d56d9