CVE-2026-99017

What it actually does

Kernel configuration dependency error prevents RISCV_ALTERNATIVE_EARLY from being enabled when ERRATA_THEAD_GHOSTWRITE is selected without ERRATA_THEAD_MAE, so errata_probe_ghostwrite never runs at the required early boot stage, ghostwrite_state is never marked VULNERABLE, ghostwrite_enable_mitigation returns false, xtheadvector remains enabled, and the CPU is incorrectly reported as not affected.

Why it matters to the business

RISC-V systems using T-Head C9xx CPUs may ship or boot with an incomplete kernel that silently leaves a hardware vulnerability unmitigated, increasing exposure on recently built kernels despite the errata option being turned on.

How an attack unfolds

An attacker with local access on an affected T-Head system benefits from the missing early-boot mitigation; because ghostwrite_state remains unset, the kernel does not disable the vulnerable xtheadvector extension, allowing subsequent local exploitation of the underlying Ghostwrite hardware issue.

How to fix it

Rebuild the kernel ensuring ERRATA_THEAD_GHOSTWRITE selects RISCV_ALTERNATIVE_EARLY; enable both errata options together, apply the resulting kernel, and verify the early boot stage now correctly marks vulnerable state and applies mitigation.

How to confirm the fix worked

After the corrected kernel boots, confirm CONFIG_RISCV_ALTERNATIVE_EARLY is present, check that ghostwrite_state is recorded as VULNERABLE on affected hardware, verify xtheadvector is disabled by the mitigation, and confirm sysfs reports the proper affected status.

Typical attack path

1. Build or obtain a kernel with ERRATA_THEAD_GHOSTWRITE=y but ERRATA_THEAD_MAE=n
2. Boot on T-Head C9xx hardware so early alternatives never execute
3. Observe sysfs reporting 'Not affected' and xtheadvector still enabled
4. Execute local code that relies on the unmitigated Ghostwrite behavior

How to detect it

Inspect kernel build configuration for the presence of both ERRATA_THEAD_GHOSTWRITE and RISCV_ALTERNATIVE_EARLY; on running systems examine sysfs cpu vulnerability files and dmesg for ghostwrite_state and mitigation status on T-Head hardware.

What your security team should do

• Prioritize rebuild of any RISC-V kernels that enable ERRATA_THEAD_GHOSTWRITE without ERRATA_THEAD_MAE
• Add build-time checks or Kconfig warnings to enforce the early-alternatives dependency for Ghostwrite errata
• Audit recently deployed T-Head-based systems for incorrect 'Not affected' status in sysfs