In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during teardown The non-Sstc hrtimer… (CVE-2026-98464)

The vulnerability in the Linux kernel affects the RISC-V KVM subsystem's handling of high-resolution timers (hrtimer) during teardown. Specifically, the non-Sstc hrtimer callback clears the next_set flag before the final use of the vCPU. If the teardown process observes next_set as false while the callback is still executing, it skips hrtimer_cancel(), allowing kvm_destroy_vcpus() to free the vCPU prematurely. This leads to a use-after-free condition detected by KASAN during spinlock operations. The race condition can be triggered by a guest arming the timer via SBI TIME and requesting shutdown via SBI legacy shutdown or SRST, with the host VM monitor destroying the VM upon KVM_EXIT_SYSTEM_EVENT. The patch ensures hrtimer_cancel() synchronizes with any running callback, blocking teardown until safe, thus preventing the use-after-free.

This vulnerability can cause a use-after-free condition in the kernel, potentially leading to kernel crashes or undefined behavior. It affects the stability and security of the host running RISC-V KVM virtual machines. There is no indication of remote code execution or privilege escalation in the provided data. Exploitation requires specific timing and guest cooperation to trigger the race condition.

A patch has been applied to synchronize hrtimer_cancel() with any running callback during vCPU teardown, preventing use-after-free errors. Users should update to the fixed Linux kernel version containing this patch. Since this is a kernel-level fix, no additional mitigation is required beyond applying the official patch. Patch status is confirmed by the vendor advisory describing the fix.