CVE-2026-23217: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23217 is a deadlock vulnerability in the Linux kernel's RISC-V tracing subsystem, specifically involving snapshot tracing of SBI (Supervisor Binary Interface) ecall functions. When __sbi_ecall is traced with snapshot functionality enabled, it triggers a recursive loop of IPI interrupts and ring buffer snapshots, causing a kernel deadlock. The vulnerability affects Linux kernel versions 6.10.10 through 6.11 and 6.11.1 through 6.18.10 (exclusive), as well as release candidates 6.19-rc1 through 6.19-rc4. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper locking (CWE-667) in the interaction between the kernel's ftrace snapshot mechanism and RISC-V SBI ecall functions. When a user with tracing privileges writes __sbi_ecall:snapshot to /sys/kernel/tracing/set_ftrace_filter, the __sbi_ecall function triggers a ring buffer snapshot, which raises an IPI (Inter-Processor Interrupt). This IPI results in another call to __sbi_ecall, which triggers another snapshot, creating an infinite recursive loop. On RISC-V systems without the SSTC (Supervisor-mode Timer Counter) extension, the timer subsystem (timer-riscv.c) issues periodic SBI ecalls, making the deadlock trivially easy to trigger without any explicit attacker action beyond enabling the trace filter. The fix permanently excludes sbi_ecall.c functions from function tracing, as SBI ecalls can still be observed via trace events (Red Hat Bugzilla).

Successful exploitation causes the kernel to enter an infinite loop of recursive IPI interrupts and snapshots, resulting in a complete system hang that requires a physical reboot to recover. The impact is limited to availability (no confidentiality or integrity loss), but the denial-of-service is total — the entire system becomes unresponsive. On RISC-V hardware without the SSTC extension, the vulnerability can be triggered automatically by the periodic timer subsystem once tracing is enabled, making recovery without physical access impossible (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is 0.000180 (very low probability of exploitation in the near term). Exploitation requires local access with low privileges sufficient to write to the kernel tracing interface (/sys/kernel/tracing/set_ftrace_filter), which is typically restricted to root or users with CAP_SYS_ADMIN. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. It is detectable via Nessus plugin 299443 (Red Hat Advisory).

1. Prerequisite: Obtain local access to a RISC-V system running Linux kernel 6.10.10–6.11 or 6.11.1–6.18.9, with privileges to write to the kernel tracing interface (typically root or CAP_SYS_ADMIN).
2. Identify vulnerability: Confirm the kernel version and RISC-V architecture, and check whether CONFIG_RISCV_ALTERNATIVE_EARLY is not set (which would otherwise exclude sbi_ecall.c from tracing).
3. Enable snapshot tracing on sbi_ecall: Write the snapshot trace filter to the ftrace interface:

   echo "__sbi_ecall:snapshot" > /sys/kernel/tracing/set_ftrace_filter

4. Trigger the deadlock: On systems without the SSTC extension, the periodic timer (timer-riscv.c) will automatically issue an SBI ecall, triggering the recursive snapshot loop. On systems with SSTC, a single manual invocation of any code path calling __sbi_ecall is sufficient.
5. Result: The kernel enters an infinite loop of IPI interrupts and ring buffer snapshots, causing a complete system hang requiring a hard reboot (Red Hat Bugzilla).

• Logs: Kernel logs (dmesg) may show repeated or stalled IPI-related messages before the system becomes unresponsive; absence of further log entries after tracing is enabled may indicate a hang.
• File System / Tracing Interface: Presence of __sbi_ecall:snapshot in /sys/kernel/tracing/set_ftrace_filter on a vulnerable kernel version is a direct indicator of attempted or successful exploitation.
• System Behavior: Complete system unresponsiveness on a RISC-V host following modification of ftrace filter settings, requiring a hard reboot to recover.

The fix is to update the Linux kernel to a version where sbi_ecall.c functions are unconditionally excluded from function tracing. Stable kernel patches are available via commits b0d7f5f0c9f05f1b6d4ee7110f15bef9c11f9df0 and b1f8285bc8e3508c1fde23b5205f1270215d4984 on git.kernel.org; the fix is included in kernel 6.18.10 and later for the 6.18 series. As interim workarounds: restrict write access to /sys/kernel/tracing/set_ftrace_filter to trusted users only; enable CONFIG_RISCV_ALTERNATIVE_EARLY if the build configuration permits (this excludes sbi_ecall.c from tracing by default); or ensure RISC-V hardware with the SSTC extension is used to eliminate periodic timer-based SBI ecalls. Red Hat has tracked this issue under Bugzilla ID 2440634 (Red Hat Bugzilla, Red Hat Advisory).