CVE-2026-98464 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel and RISC-V KVM environments should assess exposure and prioritize patching. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Additionally, they should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed and review compensating controls for exposed systems while remediation is scheduled and

Why it matters

Defenders should prioritize patching CVE-2026-98464 due to potential system instability and denial of service (DoS) risks in Linux kernel and RISC-V KVM environments.

• Potential slab-use-after-free error leading to system instability
• Possible denial of service (DoS) due to vCPU destruction
• Verification priority for affected Linux kernel and RISC-V KVM environments

Technical summary

The vulnerability occurs in the Linux kernel's RISC-V KVM implementation, specifically in the hrtimer callback during teardown. The fix involves always invoking hrtimer_cancel() for an initialized timer and synchronizing with a running callback. This ensures that the vCPU is not freed before the callback completes, preventing the slab-use-after-free error. The issue can be triggered by a guest arming the timer with SBI TIME and requesting shutdown with SBI legacy shutdown or SRST. The fix was tested with a widened callback window and KASAN reported no error in 100 fixed-and-widened runs or 200 fix-only timing-sweep runs.

Defensive priority

Defenders should prioritize patching this vulnerability, especially in environments using the RISC-V KVM implementation.

Recommended defensive actions

• Patch the Linux kernel with the provided fix
• Verify that the fix is applied and the vulnerability is not exploitable in the environment
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was reported by an unknown source and was resolved by always invoking hrtimer_cancel() for an initialized timer. The fix was tested with a widened callback window and KASAN reported no error in 100 fixed-and-widened runs or 200 fix-only timing-sweep runs.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.