UBUNTU-CVE-2026-80896: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: mshv: Fix race in mshvirqfddeassign mshvirqfddeactivate() and the hlist traversal of ptirqfdslist require pt->ptirqfdslock to be held, but mshvirqfddeassign() omits it. This races with the EPOLLHUP path in mshvirqfdwakeup(), which does take the lock before calling mshvirqfddeactivate(). Additionally, mshvirqfddeactivate() uses hlistdel() which poisons the node pointers rather than resetting them. Since mshvirqfdisactive() relies on hlistunhashed() (checks pprev == NULL), a poisoned node still appears active. If a concurrent path calls mshvirqfddeactivate() again on the same irqfd, the guard fails to prevent a double hlistdel() on poisoned pointers. Fix both issues: - Add the missing spinlockirq/spinunlockirq around the list traversal in mshvirqfddeassign(), matching mshvirqfdrelease(). - Use hlistdelinit() instead of hlistdel() so the node is properly marked as unhashed after removal, making the isactive guard reliable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In mshv_irqfd_deactivate(), use hlist_del_init() instead of hlist_del() so the node is marked unhashed and its pointers are reset, preventing a concurrent second deactivation from double-deleting poisoned pointers.
- Compensating control
In mshv_irqfd_deassign(), add spin_lock_irq() and spin_unlock_irq() around traversal of pt_irqfds_list, using pt->pt_irqfds_lock to synchronize with mshv_irqfd_deactivate() and the EPOLLHUP path in mshv_irqfd_wakeup().
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are listed as affected?
The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.
What conditions are involved in triggering the race?
The issue involves concurrent handling of irqfd deassignment and the EPOLLHUP wakeup path. The deassignment path traverses the pt_irqfds_list without the lock that the EPOLLHUP path holds before deactivating an irqfd.
What failure can result from the race?
A concurrent path can attempt to deactivate the same irqfd twice. Because the prior removal can leave poisoned list pointers that still appear active to the guard, this can lead to a second hlist_del() on poisoned pointers.