PT-2026-86187 · Linux · Linux
CVE-2026-80896
·
Published
2026-09-04
·
Updated
2026-09-04
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
mshv: Fix race in mshv irqfd deassign
mshv irqfd deactivate() and the hlist traversal of pt irqfds list
require pt->pt irqfds lock to be held, but mshv irqfd deassign()
omits it. This races with the EPOLLHUP path in mshv irqfd wakeup(),
which does take the lock before calling mshv irqfd deactivate().
Additionally, mshv irqfd deactivate() uses hlist del() which poisons
the node pointers rather than resetting them. Since
mshv irqfd is active() relies on hlist unhashed() (checks pprev ==
NULL), a poisoned node still appears active. If a concurrent path calls
mshv irqfd deactivate() again on the same irqfd, the guard fails to
prevent a double hlist del() on poisoned pointers.
Fix both issues:
- Add the missing spin lock irq/spin unlock irq around the list traversal in mshv irqfd deassign(), matching mshv irqfd release().
- Use hlist del init() instead of hlist del() so the node is properly marked as unhashed after removal, making the is active guard reliable.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux