CVE-2026-98639: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-2qhr-3xrg-mw89
Share
Published
Advisory Summary

CVE-2026-98639 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-98639 at a Glance

CVE Identifier CVE-2026-98639
GHSA Identifier GHSA-2qhr-3xrg-mw89
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-98639

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-98639, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: KVM: riscv: Fix NACL hfence entry update order The SBI v3.0 specification (section 15.1.2) requires a nested HFENCE entry to be populated as follows: 1) find an unused entry with Config.Pending == 0 2) update the Page_Number and Page_Count words 3) update the Config word with Config.Pending set __kvm_riscv_nacl_hfence() writes the Config word first, so the SBI implementation (or NACL hardware) can observe a pending entry with pnum/pcount values left over from the previous use of that entry, resulting in incorrect TLB flush ranges. Write pnum and pcount first and the Config word last. Since the consumer is an external agent on coherent shared memory, use WRITE_ONCE() to stop the compiler from reordering the stores and smp_wmb() to make the parameter words globally visible before the Pending bit is set.

References

NVD — CVE-2026-98639 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-98639
git.kernel.org/stable/c/6da4665026... WEB
https://git.kernel.org/stable/c/6da466502621381fa88a6684290923d25c559266
git.kernel.org/stable/c/b3d346838e... WEB
https://git.kernel.org/stable/c/b3d346838ec65fac7fd83f5dbcedd13cadfffddb
git.kernel.org/stable/c/d6de766d8d... WEB
https://git.kernel.org/stable/c/d6de766d8d26d71b714f548192099112def50a9c

Frequently Asked Questions

What is CVE-2026-98639?
CVE-2026-98639 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-98639?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-98639?
CVE-2026-98639 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-98639?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-2qhr-3xrg-mw89",
  "modified" : "2026-10-18T18:31:57Z",
  "published" : "2026-10-18T18:31:57Z",
  "aliases" : [ "CVE-2026-98639" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: riscv: Fix NACL hfence entry update order\n\nThe SBI v3.0 specification (section 15.1.2) requires a nested HFENCE\nentry to be populated as follows:\n1) find an unused entry with Config.Pending == 0\n2) update the Page_Number and Page_Count words\n3) update the Config word with Config.Pending set\n\n__kvm_riscv_nacl_hfence() writes the Config word first, so the SBI\nimplementation (or NACL hardware) can observe a pending entry with\npnum/pcount values left over from the previous use of that entry,\nresulting in incorrect TLB flush ranges.\n\nWrite pnum and pcount first and the Config word last. Since the\nconsumer is an external agent on coherent shared memory, use\nWRITE_ONCE() to stop the compiler from reordering the stores and\nsmp_wmb() to make the parameter words globally visible before the\nPending bit is set.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-98639"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6da466502621381fa88a6684290923d25c559266"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b3d346838ec65fac7fd83f5dbcedd13cadfffddb"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/d6de766d8d26d71b714f548192099112def50a9c"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-10-18T16:17:17Z"
  }
}