High 7.0Published Oct 23, 2026

CVE-2026-99017riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE

Updated under an hour ago (Oct 26, 2026, 6:00 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.21%, higher than 10% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE errata_probe_ghostwrite() only marks the CPU as vulnerable when it is called at the RISCV_ALTERNATIVES_EARLY_BOOT stage, and the mitigation in ghostwrite_enable_mitigation() only takes effect if the vulnerable state was recorded before the boot alternatives are patched. The early boot stage is only executed when CONFIG_RISCV_ALTERNATIVE_EARLY is enabled, which currently is only selected by ERRATA_THEAD_MAE. In a kernel built with ERRATA_THEAD_GHOSTWRITE=y but ERRATA_THEAD_MAE=n, the early alternatives never run, so ghostwrite_state is never set to VULNERABLE: ghostwrite_enable_mitigation() returns false, xtheadvector remains enabled, and sysfs reports "Not affected" on a vulnerable T-Head C9xx CPU. Select RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE so that the vulnerability is detected in the early boot stage and the default mitigation is applied.

CVSS: 7.0 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.21% (percentile 10)
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 24, 2026
First seen by InfoSec Signals: Oct 23, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 4bf97069239bcfca9840936313c7ac35a6e04488 before fa465a7819ecbe5801b78c088d3cadaf2664b8ca; from 4bf97069239bcfca9840936313c7ac35a6e04488 before 7fee577a2fa78b9a76da015beec1ccf978746ebb; from 4bf97069239bcfca9840936313c7ac35a6e04488 before 298510bbc7c3017c0faf481c6ea66f1065b657b4	CNA record

References

https://git.kernel.org/stable/c/fa465a7819ecbe5801b78c088d3cadaf2664b8ca
https://git.kernel.org/stable/c/7fee577a2fa78b9a76da015beec1ccf978746ebb
https://git.kernel.org/stable/c/298510bbc7c3017c0faf481c6ea66f1065b657b4

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.