{
  "cveId": "CVE-2026-99017",
  "url": "https://patchblox.com/security/cve/CVE-2026-99017",
  "summary": "CVE-2026-99017 is fixed in linux on 1 platform by DEBIAN-CVE-2026-99017 (version 7.2.11-1), released October 24, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  riscv: errata: select RISCV_ALTERNATIVE_EARLY fo...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE  errata_probe_ghostwrite() only marks the CPU as vulnerable when it is called at the RISCV_ALTERNATIVES_EARLY_BOOT stage, and the mitigation in ghostwrite_enable_mitigation() only takes effect if the vulnerable state was recorded before the boot alternatives are patched.  The early boot stage is only executed when CONFIG_RISCV_ALTERNATIVE_EARLY is enabled, which currently is only selected by ERRATA_THEAD_MAE. In a kernel built with ERRATA_THEAD_GHOSTWRITE=y but ERRATA_THEAD_MAE=n, the early alternatives never run, so ghostwrite_state is never set to VULNERABLE: ghostwrite_enable_mitigation() returns false, xtheadvector remains enabled, and sysfs reports \u0022Not affected\u0022 on a vulnerable T-Head C9xx CPU.  Select RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE so that the vulnerability is detected in the early boot stage and the default mitigation is applied.",
  "published": "2026-10-23T13:17:24Z",
  "severity": "high",
  "cvss": 7,
  "cvssVector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00163,
  "epssPercentile": 0.05547,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.11-1",
      "fix": "DEBIAN-CVE-2026-99017",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-99017",
      "released": "2026-10-24T13:25:57Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}