Description
In the Linux kernel, the following vulnerability has been resolved:

mshv: Fix race in mshv_irqfd_deassign

mshv_irqfd_deactivate() and the hlist traversal of pt_irqfds_list
require pt->pt_irqfds_lock to be held, but mshv_irqfd_deassign()
omits it. This races with the EPOLLHUP path in mshv_irqfd_wakeup(),
which does take the lock before calling mshv_irqfd_deactivate().

Additionally, mshv_irqfd_deactivate() uses hlist_del() which poisons
the node pointers rather than resetting them. Since
mshv_irqfd_is_active() relies on hlist_unhashed() (checks pprev ==
NULL), a poisoned node still appears active. If a concurrent path calls
mshv_irqfd_deactivate() again on the same irqfd, the guard fails to
prevent a double hlist_del() on poisoned pointers.

Fix both issues:
- Add the missing spin_lock_irq/spin_unlock_irq around the list
traversal in mshv_irqfd_deassign(), matching mshv_irqfd_release().
- Use hlist_del_init() instead of hlist_del() so the node is properly
marked as unhashed after removal, making the is_active guard reliable.
Published: 2026-09-04
Score: n/a
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply patch
AI Analysis

Impact

The Linux kernel contains a race condition in the mshv hypervisor IRQFD handling code. A missing lock in mshv_irqfd_deassign allows concurrent access with the EPOLLHUP path, leading to double deletion of list nodes and corrupted kernel data structures. If an attacker can trigger the race, it could cause a kernel panic or unexpected kernel behavior, effectively denying availability of the system.

Affected Systems

The affected software is the Linux kernel, as identified by the vendors Linux:Linux. No specific version range is listed in the CVE data; the vulnerability applies to any kernel build that includes the unpatched msn code.

Risk and Exploitability

The CVSS score is not provided, and the EPSS score is unavailable, but the vulnerability was identified in the kernel itself. The race condition is not trivially exploitable by an unprivileged user because it requires interaction with the hypervisor IRQFD mechanism. Nonetheless, the potential for kernel corruption and reboot is significant, so the risk is considered moderate to high pending kernel mitigation.

Generated by OpenCVE AI on September 4, 2026 at 19:41 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Linux kernel to a version that includes the fixed commit 0762262ac3e70f65b3bb843fe892f8bac1562d08 and reboot the system to load the new kernel.
  • Apply the source patch directly to the kernel tree and rebuild the kernel if the distribution update is not available.
  • After the patch or upgrade, monitor system logs for hypervisor IRQFD activity to confirm that the race condition no longer occurs.

Generated by OpenCVE AI on September 4, 2026 at 19:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 04 Sep 2026 20:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362

Fri, 04 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: mshv: Fix race in mshv_irqfd_deassign mshv_irqfd_deactivate() and the hlist traversal of pt_irqfds_list require pt->pt_irqfds_lock to be held, but mshv_irqfd_deassign() omits it. This races with the EPOLLHUP path in mshv_irqfd_wakeup(), which does take the lock before calling mshv_irqfd_deactivate(). Additionally, mshv_irqfd_deactivate() uses hlist_del() which poisons the node pointers rather than resetting them. Since mshv_irqfd_is_active() relies on hlist_unhashed() (checks pprev == NULL), a poisoned node still appears active. If a concurrent path calls mshv_irqfd_deactivate() again on the same irqfd, the guard fails to prevent a double hlist_del() on poisoned pointers. Fix both issues: - Add the missing spin_lock_irq/spin_unlock_irq around the list traversal in mshv_irqfd_deassign(), matching mshv_irqfd_release(). - Use hlist_del_init() instead of hlist_del() so the node is properly marked as unhashed after removal, making the is_active guard reliable.
Title mshv: Fix race in mshv_irqfd_deassign
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-04T17:11:11.689Z

Reserved: 2026-08-26T14:34:25.800Z

Link: CVE-2026-80896

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-04T18:17:57.847

Modified: 2026-09-04T18:17:57.847

Link: CVE-2026-80896

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-04T22:15:06Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')