Linux Kernel CVE-2026-98465

Requires a RISC-V system running the Linux kernel as a KVM host with AIA IMSIC interrupt virtualization in use, plus local attacker ability (PR:L) to issue KVM device ioctls (GET/SET attribute) against an IMSIC VS-file. The flaw is only reachable by winning a timing race: the attribute ioctl must snapshot the physical CPU and HGEI of a VS-file concurrently with a vCPU migration (a KVM_RUN on another thread) that releases and reallocates that HGEI. Limiting factors that reduce realistic risk: RISC-V-only exposure, the need for existing host/VMM-level privileges, no remote reachability (AV:L), and a timing-dependent window reflected in AC:H, making reliable exploitation difficult.

The input CVSS of 7.0 (High) is driven mainly by the scope change (S:C) and high availability impact (A:H), but the exploitability metrics temper real-world urgency: the vector is local (AV:L), complexity is high (AC:H, consistent with the race window the description explains - a snapshot of the physical CPU/HGEI tuple taken before a concurrent vCPU migration releases it), and low privileges are required (PR:L), meaning the attacker must already have host-side access to issue KVM device ioctls. The threat-intel signals reinforce a measured posture rather than an emergency: EPSS is 0.20% (9th percentile), the CVE is NOT listed in CISA KEV, and no public exploit is identified in the provided data - only kernel.org patch commits and the NVD/EUVD entries. The vendor priority label is 'this_week', which is consistent with a patchable, non-emergency issue. The signals are internally consistent (low EPSS, no KEV, no PoC, local+race-gated exploitation all point the same way); there is no CVSS-vs-description conflict here, since the description confirms both the local ioctl surface and the concurrency trigger implied by AC:H. Net: a legitimate but not top-of-queue priority - real but constrained to RISC-V hosts running KVM with AIA IMSIC virtualization and a privileged local actor able to win a timing race.

On a RISC-V host running KVM with AIA IMSIC virtualization, a local privileged actor (e.g., a compromised or malicious VMM/management thread) issues a KVM GET/SET attribute ioctl against an IMSIC VS-file while, on another thread, a vCPU migration releases and reallocates the underlying HGEI. By winning this race, the attribute operation uses a stale physical-CPU/HGEI tuple and reads or writes the interrupt file now owned by a different vCPU. No public exploit code is identified in the available data, and the timing-dependent nature (AC:H) makes reliable triggering non-trivial.