In the Linux kernel, the following vulnerability has been resolved: riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE… (CVE-2026-99017)

The Linux kernel vulnerability CVE-2026-99017 concerns the RISCV architecture's handling of the ghostwrite errata. Specifically, the function errata_probe_ghostwrite() only marks the CPU as vulnerable if called during the RISCV_ALTERNATIVES_EARLY_BOOT stage, which is executed only if CONFIG_RISCV_ALTERNATIVE_EARLY is enabled. This configuration is currently selected only by ERRATA_THEAD_MAE. In kernels built with ERRATA_THEAD_GHOSTWRITE=y but ERRATA_THEAD_MAE=n, the early boot stage does not run, so the vulnerable state is never recorded. Consequently, ghostwrite_enable_mitigation() returns false, leaving the mitigation disabled and sysfs incorrectly reporting the CPU as not affected. The resolution is to select RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE to ensure early detection and application of the mitigation.

Without the fix, systems running a Linux kernel configured with ERRATA_THEAD_GHOSTWRITE=y but ERRATA_THEAD_MAE=n on vulnerable T-Head C9xx CPUs may fail to detect the ghostwrite vulnerability and not apply the mitigation. This could leave the CPU exposed to the ghostwrite errata, potentially impacting system security. The sysfs interface would also incorrectly report the CPU as not affected, misleading administrators.

A fix is available that ensures the kernel configuration selects RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE, enabling early detection and mitigation of the ghostwrite vulnerability. Users should update their Linux kernel to a version including this fix or ensure their kernel configuration includes this selection. No other mitigation steps are indicated.