CVE-2026-80896: mshv: Fix race in mshv_irqfd_deassign
In the Linux kernel, the following vulnerability has been resolved:
mshv: Fix race in mshvirqfddeassign
mshvirqfddeactivate() and the hlist traversal of ptirqfdslist require pt->ptirqfdslock to be held, but mshvirqfddeassign() omits it. This races with the EPOLLHUP path in mshvirqfdwakeup(), which does take the lock before calling mshvirqfddeactivate().
Additionally, mshvirqfddeactivate() uses hlistdel() which poisons the node pointers rather than resetting them. Since mshvirqfdisactive() relies on hlistunhashed() (checks pprev == NULL), a poisoned node still appears active. If a concurrent path calls mshvirqfddeactivate() again on the same irqfd, the guard fails to prevent a double hlistdel() on poisoned pointers.
Fix both issues: - Add the missing spinlockirq/spinunlockirq around the list traversal in mshvirqfddeassign(), matching mshvirqfdrelease(). - Use hlistdelinit() instead of hlistdel() so the node is properly marked as unhashed after removal, making the isactive guard reliable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Add spin_lock_irq()/spin_unlock_irq() around the pt_irqfds_list traversal in mshv_irqfd_deassign(), matching mshv_irqfd_release(), so pt->pt_irqfds_lock is held during traversal and deactivation.
- Compensating control
Use hlist_del_init() instead of hlist_del() in mshv_irqfd_deactivate() so removed nodes are marked unhashed and their pointers are reset, making mshv_irqfd_is_active() reliable and preventing a double hlist_del().