CVE-2026-80896

A flaw was found in the mshv component of the Linux kernel. A race condition exists in the mshv_irqfd_deassign() function due to a missing lock, which can lead to concurrent operations on interrupt file descriptors (irqfds). Additionally, the use of hlist_del() instead of hlist_del_init() can result in poisoned node pointers appearing active, allowing for a double deletion of these pointers. This combination of issues can lead to memory corruption and system instability.

mshv_irqfd_deassign() misses pt_irqfds_lock while traversing pt_irqfds_list, racing with the EPOLLHUP path that can deactivate the same irqfd under the lock. Because hlist_del() poisons node pointers and mshv_irqfd_is_active() only checks hlist_unhashed(), a second deactivate path can still treat the node as active and call hlist_del() again on poisoned pointers. This can crash the host kernel and may create list state corruption around irqfd cleanup work. For the CVSS the PR:L value is used because triggering requires local access to /dev/mshv or a VMM process context, not remote network access. The issue is not network reachable. Impact is at least local denial of service. In the paranoid view, limited confidentiality or integrity impact cannot be fully excluded because this is a race around shared kernel list state, but no arbitrary write primitive is proven.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.