CVE-2026-23217
published 2026-02-18CVE-2026-23217: In the Linux kernel, the following vulnerability has been resolved: riscv: trace: fix snapshot deadlock with sbi ecall If sbi_ecall.c's functions are…
PriorityP419medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.08%
0.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
riscv: trace: fix snapshot deadlock with sbi ecall
If sbi_ecall.c's functions are traceable,
echo "__sbi_ecall:snapshot" > /sys/kernel/tracing/set_ftrace_filter
may get the kernel into a deadlock.
(Functions in sbi_ecall.c are excluded from tracing if
CONFIG_RISCV_ALTERNATIVE_EARLY is set.)
__sbi_ecall triggers a snapshot of the ringbuffer. The snapshot code
raises an IPI interrupt, which results in another call to __sbi_ecall
and another snapshot...
All it takes to get into this endless loop is one initial __sbi_ecall.
On RISC-V systems without SSTC extension, the clock events in
timer-riscv.c issue periodic sbi ecalls, making the problem easy to
trigger.
Always exclude the sbi_ecall.c functions from tracing to fix the
potential deadlock.
sbi ecalls can easiliy be logged via trace events, excluding ecall
functions from function tracing is not a big limitation.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.18.10-1 (forky) | linux 6.18.10-1 (forky) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 1ff95eb2bebda50c4c5406caaf201e0fcb24cc8f < b1f8285bc8e3508c1fde23b5205f1270215d4984 | b1f8285bc8e3508c1fde23b5205f1270215d4984 |
| linux | linux | >= 1ff95eb2bebda50c4c5406caaf201e0fcb24cc8f < b0d7f5f0c9f05f1b6d4ee7110f15bef9c11f9df0 | b0d7f5f0c9f05f1b6d4ee7110f15bef9c11f9df0 |
| linux | linux | >= 6.10.10 < 6.11 | 6.11 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.18.10-1 | 6.18.10-1 |
| linux | linux_kernel | >= 6.10.10 < 6.11 | 6.11 |
| linux | linux_kernel | >= 6.11.1 < 6.18.10 | 6.18.10 |
| msrc | azl3_kernel_6.6.121.1-1_on_azure_linux_3.0 | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5LOW
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: riscv: trace: fix snapshot deadlock with sbi ecall
vendor_redhat·2026-02-18·CVSS 5.5
CVE-2026-23217 [MEDIUM] kernel: riscv: trace: fix snapshot deadlock with sbi ecall
kernel: riscv: trace: fix snapshot deadlock with sbi ecall
In the Linux kernel, the following vulnerability has been resolved:
riscv: trace: fix snapshot deadlock with sbi ecall
If sbi_ecall.c's functions are traceable,
echo "__sbi_ecall:snapshot" > /sys/kernel/tracing/set_ftrace_filter
may get the kernel into a deadlock.
(Functions in sbi_ecall.c are excluded from tracing if
CONFIG_RISCV_ALTERNATIVE_EARLY is set.)
__sbi_ecall triggers a snapshot of the ringbuffer. The snapshot code
raises an IPI interrupt, which results in another call to __sbi_ecall
and another snapshot...
All it takes to get into this endless loop is one initial __sbi_ecall.
On RISC-V systems without SSTC extension, the clock events in
timer-riscv.c issue periodic sbi ecalls, making the problem easy to
trigger.
Always
Microsoft
riscv: trace: fix snapshot deadlock with sbi ecall
vendor_msrc·2026-02-10·CVSS 5.5
CVE-2026-23217 [MEDIUM] riscv: trace: fix snapshot deadlock with sbi ecall
riscv: trace: fix snapshot deadlock with sbi ecall
Mariner: Mariner
Linux: Linux
Customer Action Required: Yes
Debian
CVE-2026-23217: linux - In the Linux kernel, the following vulnerability has been resolved: riscv: trac...
vendor_debian·2026·CVSS 5.5
CVE-2026-23217 [MEDIUM] CVE-2026-23217: linux - In the Linux kernel, the following vulnerability has been resolved: riscv: trac...
In the Linux kernel, the following vulnerability has been resolved: riscv: trace: fix snapshot deadlock with sbi ecall If sbi_ecall.c's functions are traceable, echo "__sbi_ecall:snapshot" > /sys/kernel/tracing/set_ftrace_filter may get the kernel into a deadlock. (Functions in sbi_ecall.c are excluded from tracing if CONFIG_RISCV_ALTERNATIVE_EARLY is set.) __sbi_ecall triggers a snapshot of the ringbuffer. The snapshot code raises an IPI interrupt, which results in another call to __sbi_ecall and another snapshot... All it takes to get into this endless loop is one initial __sbi_ecall. On RISC-V systems without SSTC extension, the clock events in timer-riscv.c issue periodic sbi ecalls, making the problem easy to trigger. Always exclude the sbi_ecall.c functions from tracing to fix the po
VulDB
Linux Kernel up to 6.18.9 riscv sbi_ecall.c deadlock (EUVD-2026-8018 / Nessus ID 299443)
vuldb·2026-05-24·CVSS 5.5
CVE-2026-23217 [MEDIUM] Linux Kernel up to 6.18.9 riscv sbi_ecall.c deadlock (EUVD-2026-8018 / Nessus ID 299443)
A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.18.9. This issue affects some unknown processing of the file sbi_ecall.c of the component riscv. Performing a manipulation results in deadlock.
This vulnerability is known as CVE-2026-23217. Access to the local network is required for this attack. No exploit is available.
It is advisable to upgrade the affected component.
OSV
CVE-2026-23217: In the Linux kernel, the following vulnerability has been resolved: riscv: trace: fix snapshot deadlock with sbi ecall If sbi_ecall
osv·2026-02-18·CVSS 5.5
CVE-2026-23217 [MEDIUM] CVE-2026-23217: In the Linux kernel, the following vulnerability has been resolved: riscv: trace: fix snapshot deadlock with sbi ecall If sbi_ecall
In the Linux kernel, the following vulnerability has been resolved: riscv: trace: fix snapshot deadlock with sbi ecall If sbi_ecall.c's functions are traceable, echo "__sbi_ecall:snapshot" > /sys/kernel/tracing/set_ftrace_filter may get the kernel into a deadlock. (Functions in sbi_ecall.c are excluded from tracing if CONFIG_RISCV_ALTERNATIVE_EARLY is set.) __sbi_ecall triggers a snapshot of the ringbuffer. The snapshot code raises an IPI interrupt, which results in another call to __sbi_ecall and another snapshot... All it takes to get into this endless loop is one initial __sbi_ecall. On RISC-V systems without SSTC extension, the clock events in timer-riscv.c issue periodic sbi ecalls, making the problem easy to trigger. Always exclude the sbi_ecall.c functions from tracing to fix the po
GHSA
GHSA-787p-86v4-hhfg: In the Linux kernel, the following vulnerability has been resolved:
riscv: trace: fix snapshot deadlock with sbi ecall
If sbi_ecall
ghsa_unreviewed·2026-02-18
CVE-2026-23217 [MEDIUM] CWE-667 GHSA-787p-86v4-hhfg: In the Linux kernel, the following vulnerability has been resolved:
riscv: trace: fix snapshot deadlock with sbi ecall
If sbi_ecall
In the Linux kernel, the following vulnerability has been resolved:
riscv: trace: fix snapshot deadlock with sbi ecall
If sbi_ecall.c's functions are traceable,
echo "__sbi_ecall:snapshot" > /sys/kernel/tracing/set_ftrace_filter
may get the kernel into a deadlock.
(Functions in sbi_ecall.c are excluded from tracing if
CONFIG_RISCV_ALTERNATIVE_EARLY is set.)
__sbi_ecall triggers a snapshot of the ringbuffer. The snapshot code
raises an IPI interrupt, which results in another call to __sbi_ecall
and another snapshot...
All it takes to get into this endless loop is one initial __sbi_ecall.
On RISC-V systems without SSTC extension, the clock events in
timer-riscv.c issue periodic sbi ecalls, making the problem easy to
trigger.
Always exclude the sbi_ecall.c functions from tracing to fi
No detection rules found.
No public exploits indexed.
2026-02-18
Published