In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Serialize IMSIC attributes with vCPU migration KVM device ioctls… (CVE-2026-98465)

The Linux kernel's RISC-V KVM subsystem had a vulnerability where KVM device ioctls were not properly serialized against KVM_RUN. This allowed the function kvm_riscv_aia_imsic_rw_attr() to snapshot IMSIC VS-file attributes (physical CPU and HGEI) before a concurrent vCPU migration released them. Consequently, the HGEI could be allocated to another vCPU before imsic_vsfile_rw() used the stale tuple, causing GET or SET attribute operations to access the new owner's interrupt file incorrectly. The vulnerability was addressed by serializing the entire IMSIC attribute operation with the target vCPU mutex, ensuring the VS-file cannot be migrated or recycled until the attribute access completes. The mutex is acquired in a killable manner to keep device ioctls interruptible while waiting for KVM_RUN to finish.

This vulnerability could cause KVM device ioctl operations to access or modify IMSIC VS-file attributes belonging to a different vCPU due to race conditions during vCPU migration. This could lead to inconsistent or incorrect interrupt handling within the virtualized environment on RISC-V platforms. No information about exploitation in the wild is available.

A fix has been implemented in the Linux kernel that serializes IMSIC attribute operations with the target vCPU mutex to prevent concurrent migration and attribute access conflicts. Users should update to the Linux kernel version that includes this fix. Since no patch links or specific versions are provided, check the official Linux kernel advisories or vendor updates for the fixed version and apply the update accordingly.