Linux Kernel CVE-2026-99017

Exploitation requires ALL of: (1) a vulnerable T-Head C9xx RISC-V CPU exposing the xtheadvector extension; (2) a kernel compiled with the specific non-default combination ERRATA_THEAD_GHOSTWRITE=y and ERRATA_THEAD_MAE=n, because only ERRATA_THEAD_MAE currently selects CONFIG_RISCV_ALTERNATIVE_EARLY - without it the RISCV_ALTERNATIVES_EARLY_BOOT stage never runs, ghostwrite_state is never set to VULNERABLE, ghostwrite_enable_mitigation() returns false, and the mitigation is silently skipped; and (3) a local account able to execute vector instructions to abuse the then-unmitigated GHOSTWRITE primitive. Limiting factors that reduce real-world risk: the flaw is local-only (AV:L), requires an authenticated low-privileged account (PR:L), targets niche RISC-V hardware, and depends on a non-default build configuration - systems built with ERRATA_THEAD_MAE enabled, non-T-Head hardware, or patched kernels are not affected.

Signals point to a real but narrowly-scoped issue rather than a broad emergency. The CVSS 7.0 (HIGH) is driven entirely by impact (C:H/I:H/A:H), while the exploitability metrics are modest: AV:L (local only), AC:H (high complexity), PR:L (needs a local account), UI:N. EPSS is low at 0.21% (10th percentile), the CVE is NOT in CISA KEV, and no public exploit is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_week', consistent with a serious-impact kernel fix that is not an active-exploitation emergency. A full SSVC decision framework (exploitation status, automatable, technical impact) is not provided in the input, so SSVC cannot be independently cross-referenced beyond the 'this_week' label. Note the impact signals conflict with the 'Information Disclosure' tag: the underlying GHOSTWRITE flaw enables arbitrary physical-memory read AND write (reflected by I:H/A:H), so the tag understates severity. The decisive risk limiter is population: the bug only manifests on vulnerable T-Head C9xx RISC-V CPUs running a kernel built with ERRATA_THEAD_GHOSTWRITE=y but ERRATA_THEAD_MAE=n - a specific, non-default combination. For that narrow set of deployments it is a genuine priority (a mitigation silently never applies and sysfs falsely reports 'Not affected'); for the broader Linux population it is not relevant.

On a T-Head C9xx RISC-V system running a kernel built with ERRATA_THEAD_GHOSTWRITE=y but ERRATA_THEAD_MAE=n, the early-boot alternative patching never runs, so the GHOSTWRITE mitigation is never applied and xtheadvector stays enabled while sysfs misleadingly reports 'Not affected'. A local, low-privileged user who can execute vector instructions could then abuse the unmitigated GHOSTWRITE flaw to read and write arbitrary physical memory. No public exploit is referenced, and exploitation is local-only with high attack complexity given the specific hardware and non-default build configuration required.