{"cve":"CVE-2026-98639","nvd":{"published":"2026-10-18T16:17:17.020","modified":"2026-10-19T10:19:28.133","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: riscv: Fix NACL hfence entry update order\n\nThe SBI v3.0 specification (section 15.1.2) requires a nested HFENCE\nentry to be populated as follows:\n1) find an unused entry with Config.Pending == 0\n2) update the Page_Number and Page_Count words\n3) update the Config word with Config.Pending set\n\n__kvm_riscv_nacl_hfence() writes the Config word first, so the SBI\nimplementation (or NACL hardware) can observe a pending entry with\npnum/pcount values left over from the previous use of that entry,\nresulting in incorrect TLB flush ranges.\n\nWrite pnum and pcount first and the Config word last. Since the\nconsumer is an external agent on coherent shared memory, use\nWRITE_ONCE() to stop the compiler from reordering the stores and\nsmp_wmb() to make the parameter words globally visible before the\nPending bit is set.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/6da466502621381fa88a6684290923d25c559266","https://git.kernel.org/stable/c/b3d346838ec65fac7fd83f5dbcedd13cadfffddb","https://git.kernel.org/stable/c/d6de766d8d26d71b714f548192099112def50a9c"],"products":[],"source":"nvd","synced_at":"2026-10-19T23:00:53.604569364+00:00"},"epss":{"cve":"CVE-2026-98639","score":0.00166,"percentile":0.05772,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}