rootpwn

high · CVSS v3 7.1

CVE-2026-98004

CVE-2026-98004 is a Linux kernel race condition in the RISC-V IOMMU command queue publishing path. It can allow software producer state to a

Overview

CVE-2026-98004 is a Linux kernel race condition in the RISC-V IOMMU command queue publishing path. It can allow software producer state to advance before the hardware tail is updated and can block other CPUs when the command queue is full. It matters because IOMMU command handling affects DMA isolation and system stability on RISC-V systems.

Description

In the Linux kernel, the following vulnerability has been resolved: iommu/riscv: Serialize command queue publishing Serialize command queue publishing so software producer state advances only after a command is written and the hardware tail is updated. Wait for hardware consumption outside the queue lock when the command queue is full so other CPUs are not blocked behind a long poll.

Impact

The flaw primarily affects integrity and availability of IOMMU command processing, with possible secondary confidentiality risk if DMA isolation is weakened. It can cause incorrect IOMMU command ordering, device DMA mapping errors, or CPU stalls when the command queue is full. Impact is most relevant to multi-CPU RISC-V Linux hosts using IOMMU-managed devices. Defenders should treat it as a kernel stability and DMA-isolation issue rather than a confirmed remote code execution.

Remediation

Apply the vendor or distribution kernel update that includes the iommu/riscv command queue serialization fix, then reboot affected hosts. Verify the running kernel version against the patch notes and confirm the fix is present. Until patched, reduce exposure by limiting untrusted or high-throughput DMA devices and monitoring kernel logs for IOMMU faults or stalls. If IOMMU is not required for the workload, consider temporarily disabling it as a compensating control, recognizing that this reduces DMA isolation.

Risk context

CVSS v3 is 7.1 (High) and no EPSS score is provided, so urgency should be driven by exposure of RISC-V Linux systems with IOMMU and patch availability. It is a high-priority kernel fix for affected platforms, especially multi-CPU or device-heavy deployments.

Affected products

  • Linux kernel
  • RISC-V IOMMU driver
  • RISC-V Linux systems

Scores

Severity
high
CVSS v2
6.6
CVSS v3
7.1
CVSS v4
—
EPSS
—

linux-kernel riscv iommu race-condition locking dma availability integrity

← All CVEs

Related CVEs

high

CVE-2026-98026

This vulnerability affects the Linux kernel's bridge multicast handling. An improper RCU usage can lead to premature freeing of port group structures, potentially causing memory corruption or crashes. The fix converts mglist to RCU and corrects initialization order.

View analysis

high

CVE-2026-98101

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source() pmc->sflist is read locklessly under rcu_read_lock() by inet6_mc_check() during packet reception in the UDP and RAW multicast receive paths. ip6_mc_source() mutated psl->sl_addr and psl->sl_count in-place when adding or removing a source filter. Additionally, when expanding the filter buffer, newpsl was published via rcu_assign_pointer() before writing the new source into the array. Because 16-byte struct in6_addr writes are not atomic and array shifting is not synchronized with RCU readers, concurrent readers in inet6_mc_check() could read torn IPv6 addresses or observe duplicated/missed source entries. Fix this by switching ip6_mc_source() to copy-on-write RCU updates: allocate and fully populate newpsl before publishing it via rcu_assign_pointer(), and reclaim the old filter via kfree_rcu(), matching ip6_mc_msfilter(). Also remove the now unused IP6_SFBLOCK macro.

View analysis

high

CVE-2026-97990

CVE-2026-97990 is a high‑severity flaw in the Linux kernel’s vdpa_sim_net driver that allows a negative TX pull result to be interpreted as a large positive length in the RX path. The bug can lead to memory corruption or denial of service when the kernel processes received packets. It was fixed by adding checks for non‑positive pull results before using the length.

View analysis

high

CVE-2026-97991

CVE-2026-97991 is a Linux kernel vulnerability affecting the vDPA block device driver. It allows out-of-range buffer offsets to be used in read/write operations, leading to potential memory corruption. The flaw can be triggered by VIRTIO_BLK_T_IN, VIRTIO_BLK_T_OUT, or VIRTIO_BLK_T_WRITE_ZEROES requests.

View analysis