Linux kernel RISC-V KVM: Use-after-free in vCPU timer teardown
Summary
A race condition in the RISC-V KVM timer code of the Linux kernel can lead to a use-after-free when a virtual machine is shut down. A guest that arms the timer and requests shutdown, combined with a VMM that destroys the VM, can cause the vCPU to be freed while the timer callback is still running. The CNA rates this 9.3 (CVSS 3.1, local attack vector, no privileges required); the impact is a crash or potential code execution on the host, and the issue is relevant mainly for RISC-V virtualization hosts.
Affected
- Linux kernel with RISC-V KVM from 5.16 onward (introduced by commit 3a9f66cb25e1)
- Stable branches before the fixes: 6.1.189, 6.6.158, 6.12.112, 6.18.55, 7.2.9 (the CNA record lists these as the first unaffected versions)
- Status for 7.3 and later is unclear in the CNA data
- Ubuntu lists its releases as not affected
Fixed in
- Upstream fix commits: 2af03b606aad, 3cc6184bd592, 9bdbae64ae0d, aaad136d56d9, e66aced74f01, ea91f05a55b8
- Stable kernels: 6.1.189, 6.6.158, 6.12.112, 6.18.55, 7.2.9 or later
- Check your distribution's kernel advisory for the fixed build version
Workaround
Unknown.
- If RISC-V KVM is not needed, do not load or use the KVM module on RISC-V hosts.
Exploitation
- No evidence of active exploitation found.
- No public exploit code found.
- The race was reproduced in testing only with artificially widened timing windows.
Our recommendation
- Check whether any host runs Linux on RISC-V with KVM; if not, no action is needed beyond normal patching.
- Apply the kernel update from your distribution that includes the fix.
- Restrict who can create or control virtual machines on affected hosts.
- Confirm the patched kernel version after the update and reboot.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux stable commit 2af03b606aad git.kernel.org
- Linux stable commit 3cc6184bd592 git.kernel.org
- Linux stable commit 9bdbae64ae0d git.kernel.org
- Linux stable commit aaad136d56d9 git.kernel.org
- Linux stable commit e66aced74f01 git.kernel.org
- Linux stable commit ea91f05a55b8 git.kernel.org
- Ubuntu security tracker CVE-2026-98464 ubuntu.com
- OSV CVE-2026-98464 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:18.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during teardown The non-Sstc hrtimer callback clears next_set before its final uses of the enclosing vCPU. If teardown observes next_set as false while the callback is still running, kvm_riscv_vcpu_timer_cancel() skips hrtimer_cancel() and kvm_destroy_vcpus() can free the vCPU before the callback enters kvm_riscv_vcpu_set_interrupt(). A guest can arm the timer with SBI TIME and request shutdown with SBI legacy shutdown or SRST. A VMM that honors KVM_EXIT_SYSTEM_EVENT and destroys the VM supplies the teardown side of the race; no post-launch host ioctl is needed to arm or request teardown. On upstream master 62cc90241548, generic KASAN reported: BUG: KASAN: slab-use-after-free in do_raw_spin_lock Write of size 4 at addr ff60000005e58898 kvm_riscv_vcpu_set_interrupt kvm_riscv_vcpu_hrtimer_expired __hrtimer_run_queues hrtimer_interrupt The object was allocated by KVM_CREATE_VCPU and freed concurrently by: kvm_destroy_vcpus kvm_arch_destroy_vm kvm_destroy_vm __fput For deterministic validation, I added mdelay(1000) immediately after the existing next_set = false assignment. This only widens the existing post-clear callback window. A no-delay trace build naturally reached the callback-after-teardown-start/before-deinit ordering in 12 of 200 runs, but 1,500 stock-kernel stress iterations did not produce a KASAN report, so natural reproduction is timing-sensitive. Always invoke hrtimer_cancel() for an initialized timer. Preserve the existing -EINVAL result when the timer is no longer set, but only after synchronizing with a running callback. With this patch, hrtimer_cancel() blocked for the full widened callback window before vCPU destruction. KASAN reported no error in 100 fixed-and-widened runs or 200 fix-only timing-sweep runs.
NVD references (6)
- https://git.kernel.org/stable/c/2af03b606aadaaeb386658ef798c79bdcdef87c1
- https://git.kernel.org/stable/c/3cc6184bd5920c9685d87f4e260568feba08650d
- https://git.kernel.org/stable/c/9bdbae64ae0dab93041ebc57ec4e93def793fc2d
- https://git.kernel.org/stable/c/aaad136d56d91252517272b68cd533e5714698d5
- https://git.kernel.org/stable/c/e66aced74f0122380603c9910a71d77618b28f0e
- https://git.kernel.org/stable/c/ea91f05a55b807ead3166546a2c75f4185ca645f
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.