Vulnerability feed

Executive summary

A flaw in the Linux kernel's RISC-V errata handling for T-Head C9xx processors means a vulnerable CPU can be reported as not affected in kernels built without a certain option. The advisory describes the issue as one that leaves the default mitigation unapplied on affected hardware, but it does not state a severity rating. The fix is a one-line Kconfig change that makes the detection run early in boot, and the advisory points to a stable kernel tree commit as the remedy.

Technical summary

This is a logic and configuration flaw in the Linux kernel's T-Head Ghostwrite errata handling, where the vulnerable state is only recorded during the early boot alternatives stage. That stage runs only when CONFIG_RISCV_ALTERNATIVE_EARLY is enabled, which was selected only by ERRATA_THEAD_MAE, so a kernel built with ERRATA_THEAD_GHOSTWRITE=y and ERRATA_THEAD_MAE=n never applies the mitigation and sysfs reports "Not affected" on a vulnerable C9xx CPU. The attack vector, exploitation preconditions beyond this build configuration, and CVSS score are not stated. The fix selects RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE, and the advisory references commit 298510bbc7c3017c0faf481c6ea66f1065b657b4. Affected and fixed kernel version numbers are not stated, and no workarounds or detection guidance beyond checking the sysfs report are given.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/298510bbc7c3017…481c6ea66f1065b657b4

Impact if exploited

How it is exploited

Attack vector

Local

Attack complexity

High

Privileges required

Low

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affects

LinuxT-HeadLinuxLinux kernelT-Head C9xx