Description
In the Linux kernel, the following vulnerability has been resolved:

riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE

errata_probe_ghostwrite() only marks the CPU as vulnerable when it is
called at the RISCV_ALTERNATIVES_EARLY_BOOT stage, and the mitigation
in ghostwrite_enable_mitigation() only takes effect if the vulnerable
state was recorded before the boot alternatives are patched.

The early boot stage is only executed when CONFIG_RISCV_ALTERNATIVE_EARLY
is enabled, which currently is only selected by ERRATA_THEAD_MAE. In a
kernel built with ERRATA_THEAD_GHOSTWRITE=y but ERRATA_THEAD_MAE=n, the
early alternatives never run, so ghostwrite_state is never set to
VULNERABLE: ghostwrite_enable_mitigation() returns false, xtheadvector
remains enabled, and sysfs reports "Not affected" on a vulnerable
T-Head C9xx CPU.

Select RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE so that the
vulnerability is detected in the early boot stage and the default
mitigation is applied.
Published: 2026-10-23
Score: 7 High
EPSS: < 1% Very Low
KEV: No
Impact: Unmitigated Hardware Ghostwrite
Action: Patch Kernel
AI Analysis

Impact

The Linux kernel fails to flag a T‑Head C9xx CPU as vulnerable to its ghostwrite erratum when CONFIG_RISCV_ALTERNATIVE_EARLY is not enabled. Because the detection routine exists only in the early boot stage, the mitigation routine is never activated for kernels built with ERRATA_THEAD_GHOSTWRITE but without early boot alternatives, resulting in the hardware fault remaining active and no sysfs notification of the issue.

Affected Systems

Linux kernels compiled with ERRATA_THEAD_GHOSTWRITE enabled but without RISCV_ALTERNATIVE_EARLY enabled are impacted. The flaw is specific to T‑Head C9xx processors, which are the only CPUs documented to suffer from this ghostwrite erratum.

Risk and Exploitability

The CVSS score of 7 classifies the problem as high severity. The EPSS score of < 1% indicates a low likelihood of exploitation in the wild. Because the kernel does not apply known mitigations, the underlying hardware flaw can cause memory corruption during system operation, potentially compromising kernel stability, data integrity, and confidentiality. This vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on November 3, 2026 at 03:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Enable RISCV_ALTERNATIVE_EARLY when ERRATA_THEAD_GHOSTWRITE is set, ensuring early‑boot detection and mitigation are applied.
  • Rebuild the kernel with the corrected configuration and deploy the updated image to all affected hosts.
  • If an immediate rebuild is not possible, disable ERRATA_THEAD_GHOSTWRITE or upgrade to a kernel version that includes the early‑boot detection fix to prevent the hardware erratum from remaining unmitigated.

Generated by OpenCVE AI on November 3, 2026 at 03:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-9018-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-9018-2 Linux kernel (HWE) vulnerabilities
Ubuntu USN Ubuntu USN USN-9019-1 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-9020-1 Linux kernel vulnerabilities
History

Tue, 03 Nov 2026 02:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-665

Tue, 03 Nov 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-440
References
Metrics threat_severity

None

 threat_severity

Moderate

Sun, 25 Oct 2026 01:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-665

Sat, 24 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-704

Sat, 24 Oct 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Fri, 23 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Linux linux
Vendors & Products Linux linux

Fri, 23 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
CWE-704

Fri, 23 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE errata_probe_ghostwrite() only marks the CPU as vulnerable when it is called at the RISCV_ALTERNATIVES_EARLY_BOOT stage, and the mitigation in ghostwrite_enable_mitigation() only takes effect if the vulnerable state was recorded before the boot alternatives are patched. The early boot stage is only executed when CONFIG_RISCV_ALTERNATIVE_EARLY is enabled, which currently is only selected by ERRATA_THEAD_MAE. In a kernel built with ERRATA_THEAD_GHOSTWRITE=y but ERRATA_THEAD_MAE=n, the early alternatives never run, so ghostwrite_state is never set to VULNERABLE: ghostwrite_enable_mitigation() returns false, xtheadvector remains enabled, and sysfs reports "Not affected" on a vulnerable T-Head C9xx CPU. Select RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE so that the vulnerability is detected in the early boot stage and the default mitigation is applied.
Title riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-24T14:10:04.808Z

Reserved: 2026-09-25T10:25:14.386Z

Link: CVE-2026-99017

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-23T13:17:24.530

Modified: 2026-10-24T14:16:52.790

Link: CVE-2026-99017

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-23T12:20:53Z

Links: CVE-2026-99017 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-11-03T03:30:14Z

Weaknesses
  • CWE-440

    Expected Behavior Violation