CVE-2026-23217

CVE-2026-23217 describes a deadlock vulnerability in the Linux kernel affecting RISC-V systems. Specifically, enabling function tracing for sbi_ecall.c functions can trigger an infinite loop when a snapshot is initiated, as the snapshot process itself calls sbi_ecall, leading to recursive snapshots. This can easily be triggered on RISC-V systems without the SSTC extension due to periodic sbi ecalls. The vulnerability has no assigned CVSS score, but its FAUCET Risk Score is 20/100, indicating a moderate risk. The attack vector involves enabling specific tracing, leading to a denial of service through system deadlock. The fix involves always excluding sbi_ecall.c functions from tracing. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage are minimal, with only one mention and one article identified, suggesting low current attention.