In the Linux kernel, the following vulnerability has been resolved: KVM: riscv: Fix NACL hfence entry update order The SBI v3.0 specification… (CVE-2026-98639)

The Linux kernel's KVM module for RISC-V had a vulnerability related to the nested HFENCE entry update order. According to the SBI v3.0 specification, a nested HFENCE entry must be updated by first finding an unused entry with Config.Pending == 0, then updating the Page_Number and Page_Count fields, and finally updating the Config word with the Pending bit set. The vulnerable code wrote the Config word first, allowing an external agent (such as the SBI implementation or NACL hardware) to observe a pending entry with stale page number and count values, potentially causing incorrect TLB flush ranges. The fix changes the update order to write the page number and count first, then the Config word last, using WRITE_ONCE() to prevent compiler reordering and smp_wmb() to ensure memory visibility.

The vulnerability could lead to incorrect TLB flush ranges due to stale page number and count values being observed by external agents relying on the nested HFENCE entries. This could affect the correctness of memory management and isolation in virtualized environments using KVM on RISC-V. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to correct the update order of the nested HFENCE entry in the KVM RISC-V code. Users should update to a Linux kernel version that includes this fix. Since no specific patch links or versions are provided, check the vendor or kernel release notes for the official fix. No additional mitigation is indicated.