CVE-2026-80895

A flaw was found in the mshv component of the Linux kernel. A local user could exploit a race condition during the creation of a Virtual Processor (VP) and the assertion of an interrupt file descriptor (irqfd). This could lead to the use of partially initialized VP fields, potentially causing system instability or a denial of service (DoS).

A race in the mshv irqfd fast path can allow mshv_try_assert_irq_fast() to observe a non NULL VP pointer while mshv_partition_ioctl_create_vp() is still publishing the newly initialized VP state. On weakly-ordered architectures this can expose partially initialized fields such as vp_register_page to a lockless reader and may cause incorrect interrupt delivery, VMM failure, or a host kernel denial of service. For the CVSS the PR:L value is used because triggering requires local access to /dev/mshv and the ability to create VP and irqfd state, but this may be available to a VMM process or a reduced capability service account rather than full host administrator access. The issue is not network reachable and is triggered through local mshv device operations. Impact is at least local denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.