Linux Kernel up to 6.18.9 riscv sbi_ecall.c deadlock

Summaryinfo

A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.18.9. Impacted is an unknown function of the file sbi_ecall.c of the component riscv. Executing a manipulation can lead to deadlock. This vulnerability is handled as CVE-2026-23217. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.18.9. It has been declared as critical. This vulnerability affects some unknown functionality of the file sbi_ecall.c of the component riscv. The manipulation with an unknown input leads to a deadlock vulnerability. The CWE definition for the vulnerability is CWE-833. The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock. As an impact it is known to affect availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: riscv: trace: fix snapshot deadlock with sbi ecall If sbi_ecall.c's functions are traceable, echo "__sbi_ecall:snapshot" > /sys/kernel/tracing/set_ftrace_filter may get the kernel into a deadlock. (Functions in sbi_ecall.c are excluded from tracing if CONFIG_RISCV_ALTERNATIVE_EARLY is set.) __sbi_ecall triggers a snapshot of the ringbuffer. The snapshot code raises an IPI interrupt, which results in another call to __sbi_ecall and another snapshot... All it takes to get into this endless loop is one initial __sbi_ecall. On RISC-V systems without SSTC extension, the clock events in timer-riscv.c issue periodic sbi ecalls, making the problem easy to trigger. Always exclude the sbi_ecall.c functions from tracing to fix the potential deadlock. sbi ecalls can easiliy be logged via trace events, excluding ecall functions from function tracing is not a big limitation.

The advisory is shared for download at git.kernel.org. This vulnerability was named CVE-2026-23217 since 01/13/2026. The exploitation appears to be difficult. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 299443 (Linux Distros Unpatched Vulnerability : CVE-2026-23217), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.18.10 eliminates this vulnerability. Applying the patch b1f8285bc8e3508c1fde23b5205f1270215d4984/b0d7f5f0c9f05f1b6d4ee7110f15bef9c11f9df0 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (299443), EUVD (EUVD-2026-8018) and CERT Bund (WID-SEC-2026-0462). Once again VulDB remains the best source for vulnerability data.

Affected

• Open Source Linux Kernel

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.18.0
• 6.18.1
• 6.18.2
• 6.18.3
• 6.18.4
• 6.18.5
• 6.18.6
• 6.18.7
• 6.18.8
• 6.18.9

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion