The flaw stems from the Linux kernel’s KVM module for RISC‑V incorrectly ordering writes to the NACL HFENCE data structure. The patch reveals that the kernel writes the Config word before setting the Page_Number and Page_Count, allowing a hardware or SBI implementation to observe a pending entry with stale page numbers. This can cause the TLB to be flushed for incorrect ranges, potentially leading to kernel memory corruption or loss of data consistency. The weakness is a race condition due to improper memory ordering (CWE-362).

All Linux kernels that enable KVM on RISC‑V with the NACL HFENCE feature have been affected before the patch was merged. The vulnerability is present in kernels prior to commit 6da4665 and applies to systems running those kernels on RISC‑V hardware. The fix is incorporated in Linux kernel version 6.7 and later releases.

The CVSS vector is not disclosed, and EPSS is not available, so the risk cannot be quantified. This issue is not listed in the CISA KEV catalog. An attacker would need to execute code with privileged KVM access or manipulate the HFENCE entries, which typically requires local or privileged guest control. Based on the description, it is inferred that a successful exploitation could lead to a denial of service or kernel corruption, but the lack of public exploits suggests a moderate risk.