CVE-2026-99017 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE
errata_probe_ghostwrite() only marks the CPU as vulnerable when it is called at the RISCV_ALTERNATIVES_EARLY_BOOT stage, and the mitigation in ghostwrite_enable_mitigation() only takes effect if the vulnerable state was recorded before the boot alternatives are patched.
The early boot stage is only executed when CONFIG_RISCV_ALTERNATIVE_EARLY is enabled, which currently is only selected by ERRATA_THEAD_MAE. In a kernel built with ERRATA_THEAD_GHOSTWRITE=y but ERRATA_THEAD_MAE=n, the early alternatives never run, so ghostwrite_state is never set to VULNERABLE: ghostwrite_enable_mitigation() returns false, xtheadvector remains enabled, and sysfs reports "Not affected" on a vulnerable T-Head C9xx CPU.
Select RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE so that the vulnerability is detected in the early boot stage and the default mitigation is applied.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The Linux kernel contains a configuration dependency flaw within the RISC-V architecture errata handling logic, specifically affecting T-Head GHOSTWRITE vulnerabilities on C9xx CPUs. This issue stems from an incorrect selection of the RISCV_ALTERNATIVE_EARLY feature flag by the ERRATA_THEAD_GHOSTWRITE configuration option. The vulnerability detection and mitigation mechanisms rely heavily on precise timing during the kernel boot process to ensure that hardware workarounds are applied before critical subsystems initialize. Specifically, the function errata_probe_ghostwrite is designed to identify vulnerable CPU states exclusively when executed at the RISCV_ALTERNATIVES_EARLY_BOOT stage. This early execution window is crucial because it allows the system to apply patch alternatives before they become permanent in the kernel text section. However, this early boot stage only executes if the CONFIG_RISCV_ALTERNATIVE_EARLY configuration option is enabled.
Historically, RISCV_ALTERNATIVE_EEARLY was selected solely by ERRATA_THEAD_MAE, leaving it disabled when systems were configured with ERRATA_THEAD_GHOSTWRITE but without ERRATA_THEAD_MAE. In such configurations, the early alternatives code path is skipped entirely during boot. Consequently, errata_probe_ghostwrite never runs at the required stage, and the global ghostwrite_state variable remains unset to VULNERABLE. This leads to a critical failure in the mitigation chain because the subsequent function ghostwrite_enable_mitigation checks this state variable before deciding whether to apply hardware workarounds. Since the vulnerability was not detected early enough due to the missing configuration dependency, ghostwrite_enable_mitigation returns false, causing xtheadvector extensions to remain enabled despite the CPU being susceptible to GHOSTWRITE attacks.
The operational impact of this flaw is severe because it results in a false negative security posture for affected systems. Administrators and automated scanning tools relying on sysfs interfaces will report that vulnerable T-Head C9xx CPUs are not affected, creating a dangerous illusion of safety while the system remains exposed to speculative execution side-channel attacks like GHOSTWRITE. These types of vulnerabilities allow attackers to bypass memory isolation boundaries by exploiting how processors handle exceptions during speculative execution, potentially leading to unauthorized data disclosure across security domains such as between virtual machines or containerized environments. The failure to apply mitigations means that any workload running on these systems is vulnerable to sophisticated side-channel attacks that can extract sensitive cryptographic keys or other confidential information from adjacent processes.
To resolve this issue and restore proper security controls, the kernel configuration for ERRATA_THEAD_GHOSTWRITE must be updated to select RISCV_ALTERNATIVE_EARLY. This change ensures that when GHOSTWRITE errata handling is enabled, the early boot alternative patching mechanism is also activated. By doing so, the system correctly identifies vulnerable CPUs during the earliest stages of initialization and triggers ghostwrite_enable_mitigation to disable xtheadvector extensions where necessary. This alignment with industry standards such as CWE-913 for improper control of frequency throttling or resource limits in hardware errata handling ensures that mitigation logic is consistently applied regardless of other concurrent errata configurations. Furthermore, this fix aligns with ATT&CK techniques related to side-channel attacks by ensuring that the operating system actively mitigates the underlying architectural weakness rather than leaving it exposed due to configuration oversights.