{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/riscv/kvm/nacl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d6de766d8d26d71b714f548192099112def50a9c",
              "status": "affected",
              "version": "d466c19cead5904d4d5d92adb2b213b411d3b849",
              "versionType": "git"
            },
            {
              "lessThan": "6da466502621381fa88a6684290923d25c559266",
              "status": "affected",
              "version": "d466c19cead5904d4d5d92adb2b213b411d3b849",
              "versionType": "git"
            },
            {
              "lessThan": "b3d346838ec65fac7fd83f5dbcedd13cadfffddb",
              "status": "affected",
              "version": "d466c19cead5904d4d5d92adb2b213b411d3b849",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/riscv/kvm/nacl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.55",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.9",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: riscv: Fix NACL hfence entry update order\n\nThe SBI v3.0 specification (section 15.1.2) requires a nested HFENCE\nentry to be populated as follows:\n1) find an unused entry with Config.Pending == 0\n2) update the Page_Number and Page_Count words\n3) update the Config word with Config.Pending set\n\n__kvm_riscv_nacl_hfence() writes the Config word first, so the SBI\nimplementation (or NACL hardware) can observe a pending entry with\npnum/pcount values left over from the previous use of that entry,\nresulting in incorrect TLB flush ranges.\n\nWrite pnum and pcount first and the Config word last. Since the\nconsumer is an external agent on coherent shared memory, use\nWRITE_ONCE() to stop the compiler from reordering the stores and\nsmp_wmb() to make the parameter words globally visible before the\nPending bit is set."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:23:09.004Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d6de766d8d26d71b714f548192099112def50a9c"
        },
        {
          "url": "https://git.kernel.org/stable/c/6da466502621381fa88a6684290923d25c559266"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3d346838ec65fac7fd83f5dbcedd13cadfffddb"
        }
      ],
      "title": "KVM: riscv: Fix NACL hfence entry update order",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98639",
    "datePublished": "2026-10-18T15:20:10.591Z",
    "dateReserved": "2026-09-25T10:25:14.361Z",
    "dateUpdated": "2026-10-19T09:23:09.004Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}