{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.190-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.113-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.9-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  RISC-V: KVM: Synchronize hrtimer callback during teardown  The non-Sstc hrtimer callback clears next_set before its final uses of the enclosing vCPU.  If teardown observes next_set as false while the callback is still running, kvm_riscv_vcpu_timer_cancel() skips hrtimer_cancel() and kvm_destroy_vcpus() can free the vCPU before the callback enters kvm_riscv_vcpu_set_interrupt().  A guest can arm the timer with SBI TIME and request shutdown with SBI legacy shutdown or SRST.  A VMM that honors KVM_EXIT_SYSTEM_EVENT and destroys the VM supplies the teardown side of the race; no post-launch host ioctl is needed to arm or request teardown.  On upstream master 62cc90241548, generic KASAN reported:    BUG: KASAN: slab-use-after-free in do_raw_spin_lock   Write of size 4 at addr ff60000005e58898    kvm_riscv_vcpu_set_interrupt   kvm_riscv_vcpu_hrtimer_expired   __hrtimer_run_queues   hrtimer_interrupt  The object was allocated by KVM_CREATE_VCPU and freed concurrently by:    kvm_destroy_vcpus   kvm_arch_destroy_vm   kvm_destroy_vm   __fput  For deterministic validation, I added mdelay(1000) immediately after the existing next_set = false assignment.  This only widens the existing post-clear callback window.  A no-delay trace build naturally reached the callback-after-teardown-start/before-deinit ordering in 12 of 200 runs, but 1,500 stock-kernel stress iterations did not produce a KASAN report, so natural reproduction is timing-sensitive.  Always invoke hrtimer_cancel() for an initialized timer.  Preserve the existing -EINVAL result when the timer is no longer set, but only after synchronizing with a running callback.  With this patch, hrtimer_cancel() blocked for the full widened callback window before vCPU destruction.  KASAN reported no error in 100 fixed-and-widened runs or 200 fix-only timing-sweep runs.",
  "id": "DEBIAN-CVE-2026-98464",
  "modified": "2026-10-19T04:47:37.573684040Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-98464"
    }
  ],
  "upstream": [
    "CVE-2026-98464"
  ]
}