CVE-2026-80896: mshv: Fix race in mshv_irqfd_deassign

In the Linux kernel, the following vulnerability has been resolved:

mshv: Fix race in mshvirqfddeassign

mshvirqfddeactivate() and the hlist traversal of ptirqfdslist require pt->ptirqfdslock to be held, but mshvirqfddeassign() omits it. This races with the EPOLLHUP path in mshvirqfdwakeup(), which does take the lock before calling mshvirqfddeactivate().

Additionally, mshvirqfddeactivate() uses hlistdel() which poisons the node pointers rather than resetting them. Since mshvirqfdisactive() relies on hlistunhashed() (checks pprev == NULL), a poisoned node still appears active. If a concurrent path calls mshvirqfddeactivate() again on the same irqfd, the guard fails to prevent a double hlistdel() on poisoned pointers.

Fix both issues: - Add the missing spinlockirq/spinunlockirq around the list traversal in mshvirqfddeassign(), matching mshvirqfdrelease(). - Use hlistdelinit() instead of hlistdel() so the node is properly marked as unhashed after removal, making the isactive guard reliable.