CVE-2026-99017High· 7.0▾ Twilight

riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE

In the Linux kernel, the following vulnerability has been resolved: riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE errata_probe_ghostwrite() only marks the CPU as vulnerable when it is called at the RISCV_ALTERNATIV…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score39/ 100 · Low

impact 38.5 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Oct 23, 2026

Updated

Oct 24, 2026

CVSS

7.0

Vendor

Linux

Product

Linux

CWE

—

Depth score

39 · Low

EPSS

0.16% · p5

Platforms

—

Source

CVEORG

Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Oct 24.

0.2% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

5 events · 2 days

Oct 23, 2026Published
Disclosed via CVEORG
Oct 24, 2026Record revised
Last analysed / modified upstream
Oct 24, 2026EPSS first tracked
0.2%
Oct 24, 2026CVSS changed
— → 7
Oct 24, 2026Severity changed
none → high

Linux #cve.org

Affected

Linux >= 4bf97069239bcfca9840936313c7ac35a6e04488 < fa465a7819ecbe5801b78c088d3cadaf2664b8ca
Linux >= 4bf97069239bcfca9840936313c7ac35a6e04488 < 7fee577a2fa78b9a76da015beec1ccf978746ebb
Linux >= 4bf97069239bcfca9840936313c7ac35a6e04488 < 298510bbc7c3017c0faf481c6ea66f1065b657b4
Linux 6.14

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE

errata_probe_ghostwrite() only marks the CPU as vulnerable when it is called at the RISCV_ALTERNATIVES_EARLY_BOOT stage, and the mitigation in ghostwrite_enable_mitigation() only takes effect if the vulnerable state was recorded before the boot alternatives are patched.

The early boot stage is only executed when CONFIG_RISCV_ALTERNATIVE_EARLY is enabled, which currently is only selected by ERRATA_THEAD_MAE. In a kernel built with ERRATA_THEAD_GHOSTWRITE=y but ERRATA_THEAD_MAE=n, the early alternatives never run, so ghostwrite_state is never set to VULNERABLE: ghostwrite_enable_mitigation() returns false, xtheadvector remains enabled, and sysfs reports "Not affected" on a vulnerable T-Head C9xx CPU.

Select RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE so that the vulnerability is detected in the early boot stage and the default mitigation is applied.

Affected

Linux >= 4bf97069239bcfca9840936313c7ac35a6e04488 < fa465a7819ecbe5801b78c088d3cadaf2664b8ca
Linux >= 4bf97069239bcfca9840936313c7ac35a6e04488 < 7fee577a2fa78b9a76da015beec1ccf978746ebb
Linux >= 4bf97069239bcfca9840936313c7ac35a6e04488 < 298510bbc7c3017c0faf481c6ea66f1065b657b4
Linux 6.14

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Change history

Field changes observed since this record was first indexed.

Oct 24, 2026CVSS — → 7
Oct 24, 2026Severity none → high

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score39/ 100 · Low

impact 38.5 · likelihood 0 · exploitation 0

Overview

In the Linux kernel, the following vulnerability has been resolved:

riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE

Select RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE so that the vulnerability is detected in the early boot stage and the default mitigation is applied.