CVE-2026-80896 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
mshv: Fix race in mshv_irqfd_deassign
mshv_irqfd_deactivate() and the hlist traversal of pt_irqfds_list require pt->pt_irqfds_lock to be held, but mshv_irqfd_deassign() omits it. This races with the EPOLLHUP path in mshv_irqfd_wakeup(), which does take the lock before calling mshv_irqfd_deactivate().
Additionally, mshv_irqfd_deactivate() uses hlist_del() which poisons the node pointers rather than resetting them. Since mshv_irqfd_is_active() relies on hlist_unhashed() (checks pprev == NULL), a poisoned node still appears active. If a concurrent path calls mshv_irqfd_deactivate() again on the same irqfd, the guard fails to prevent a double hlist_del() on poisoned pointers.
Fix both issues: - Add the missing spin_lock_irq/spin_unlock_irq around the list traversal in mshv_irqfd_deassign(), matching mshv_irqfd_release(). - Use hlist_del_init() instead of hlist_del() so the node is properly marked as unhashed after removal, making the is_active guard reliable.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The Linux kernel hypervisor component for Microsoft Hyper-V, known as MSHV, contains a concurrency vulnerability within its interrupt file descriptor management logic that can lead to race conditions and potential memory corruption. The core issue resides in the mshv_irqfd_deassign function, which is responsible for deactivating an interrupt file descriptor associated with a virtual machine's pass-through interrupts. This operation involves traversing a hash list of pending IRQ file descriptors protected by pt->pt_irqfds_lock. However, the implementation fails to acquire this necessary spinlock before performing the traversal and subsequent modifications. Without proper synchronization, concurrent execution paths can access or modify the shared data structure simultaneously, creating a classic race condition that compromises kernel integrity.
The operational impact is exacerbated by how the deactivation logic handles list node removal. The function mshv_irqfd_deactivate utilizes hlist_del to remove nodes from the hash list. This standard deletion routine poisons the pointers within the node rather than resetting them to null or a safe state. Concurrently, another part of the codebase relies on hlist_unhashed to determine if an IRQ file descriptor is still active by checking if its previous pointer field is NULL. Because poisoning does not set this field to NULL, the guard check incorrectly reports that the resource remains active even after it has been logically removed from the list. This discrepancy allows a concurrent thread or interrupt handler to perceive the deactivated resource as valid and attempt further operations on it.
This flaw creates a specific scenario where double deletion can occur. If an EPOLLHUP event triggers mshv_irqfd_wakeup, which correctly acquires the lock before calling deactivate, but another path invokes deassign without holding the lock, both may proceed to manipulate the same node. The poisoned pointers prevent the active state check from failing as expected, leading to a second invocation of hlist_del on already corrupted memory structures. Such double frees or invalid list manipulations can result in kernel panics, denial of service for affected virtual machines, or potentially exploitable conditions where an attacker might leverage use-after-free semantics to achieve arbitrary code execution within the hypervisor context.
To mitigate this vulnerability, two primary technical corrections are required and have been implemented in updated kernels. First, synchronization must be enforced by wrapping the list traversal and modification logic in mshv_irqfd_deassign with spin_lock_irq and spin_unlock_irq calls. This ensures exclusive access to the pt_irqfds_list during critical sections, preventing concurrent modifications from different execution contexts such as interrupt handlers or file descriptor release paths. Second, the deletion mechanism must be changed from hlist_del to hlist_del_init. The latter function properly initializes the node pointers after removal, ensuring that subsequent checks for activity via hlist_unhashed return accurate results and prevent double-deletion attempts on poisoned memory structures.
From a classification perspective, this vulnerability aligns with CWE-362, which describes concurrent execution using shared resources with improper synchronization. The lack of locking around critical data structure manipulation allows multiple threads to interfere with each other's operations. Furthermore, the resulting potential for use-after-free scenarios through double deletion maps closely to CWE-415, Double Free, and CWE-823, Use of Out-of-range Pointer Offset if the poisoned pointers lead to invalid memory accesses. In terms of attack vectors, this falls under ATT&CK technique T1059, Command and Scripting Interpreter, specifically within the context of kernel-level exploitation where an attacker might leverage race conditions in hypervisor components to escalate privileges or disrupt virtualization services.
System administrators and developers should ensure that Linux kernels are updated to versions containing these specific patches for mshv_irqfd_deassign. The fix addresses both the synchronization gap and the incorrect state management of list nodes, thereby restoring the integrity of interrupt file descriptor handling in Hyper-V passthrough scenarios. Regular patching cycles are essential to maintain security posture against such low-level concurrency bugs that can undermine the stability and isolation guarantees provided by virtualization platforms.