CVE-2026-80895

In the Linux kernel, the following vulnerability has been resolved:

mshv: Order pt vp array publish against irqfd assertion path

mshv partition ioctl create vp() initialises a VP struct (allocations, mutex init, init waitqueue head, page mappings) and then publishes the pointer into partition->pt vp array. Several ISR paths read this array locklessly: the intercept ISR, the two scheduler ISRs, and mshv try assert irq fast() on the irqfd fast path.

Of these, only mshv try assert irq fast() can structurally race the publish. It runs from an eventfd waker without holding pt mutex, and MSHV IRQFD does not require the target lapic apic id (== vp index) to refer to an existing VP at registration time. A user can therefore register an irqfd targeting a yet-to-be-created VP, then trigger mshv try assert irq fast() concurrently with MSHV CREATE VP for the same index. On weakly-ordered architectures the reader can observe a non-NULL pointer in pt vp array before the initialising stores to the VP struct become visible, leading to use of partially-initialised fields (e.g. vp register page).

The other ISR readers cannot reach this race: the hypervisor will not generate intercept or scheduler messages for a VP that has never been told to run, and the user can only call MSHV RUN VP on the VP fd returned by MSHV CREATE VP, which by construction is returned after the publish. Leave those readers as plain loads.

Use smp store release() in mshv partition ioctl create vp() to publish the pointer, and pair it with smp load acquire() in mshv try assert irq fast(). On x86 these compile to plain accesses under TSO; on ARM64 they emit one-instruction acquire/release barriers, acceptable on this fast path.

The destroy-side path (destroy partition() clearing pt vp array[i] to NULL after kfree(vp)) has a separate ordering and lifetime concern that is out of scope here.