CVE-2026-80895 Overview
CVE-2026-80895 is a race condition in the Linux kernel's Microsoft Hypervisor (mshv) subsystem. The flaw resides in mshv_partition_ioctl_create_vp(), which initializes a virtual processor (VP) structure and then publishes the pointer into partition->pt_vp_array. On weakly-ordered architectures such as ARM64, the concurrent reader mshv_try_assert_irq_fast() can observe a non-NULL pointer before the initializing stores to the VP become visible. This allows use of partially-initialized fields, including vp_register_page. The issue has been resolved upstream through the introduction of paired acquire/release memory barriers.
Critical Impact
A local user can trigger use of a partially-initialized VP structure by registering an irqfd targeting a not-yet-created VP and racing MSHV_CREATE_VP on the same index.
Affected Products
- Linux kernel mshv (Microsoft Hypervisor Root) subsystem
- Systems running Linux as a Hyper-V root partition on weakly-ordered architectures (notably ARM64)
- Kernel builds preceding commits 062aa5d, b098dc8, and eba2bf5
Discovery Timeline
- 2026-09-04 - CVE-2026-80895 published to NVD
- 2026-09-04 - Last updated in NVD database
Technical Details for CVE-2026-80895
Vulnerability Analysis
The mshv_partition_ioctl_create_vp() function performs several initialization steps on a VP structure, including allocations, mutex_init, init_waitqueue_head, and page mappings. It then publishes the pointer into partition->pt_vp_array. Multiple interrupt service routine (ISR) paths read this array without holding pt_mutex.
Only mshv_try_assert_irq_fast() can structurally race the publish. This function runs from an eventfd waker on the irqfd fast path and does not require the target lapic_apic_id (equal to vp_index) to refer to an existing VP at registration time. Other ISR readers, including the intercept ISR and scheduler ISRs, cannot reach this race because the hypervisor does not generate messages for VPs that have never been told to run.
Root Cause
The root cause is missing memory ordering between the initializing stores to the VP structure and the publish of its pointer into pt_vp_array. On weakly-ordered architectures, the reader may observe the pointer becoming non-NULL before the writes that initialize the VP's fields are globally visible. This constitutes a data race [CWE-362] leading to use of uninitialized memory.
Attack Vector
A local user with access to the /dev/mshv device registers an irqfd targeting a VP index that does not yet exist. The user then invokes MSHV_CREATE_VP for the same index while concurrently signaling the eventfd to trigger mshv_try_assert_irq_fast(). On ARM64 or similar weakly-ordered systems, the fast-path reader may dereference the newly-published pointer and access fields such as vp_register_page before initialization completes. Verified technical details are documented in the upstream commits (Git Kernel Commit 062aa5d, Git Kernel Commit b098dc8, and Git Kernel Commit eba2bf5).
The fix uses smp_store_release() in the publisher and pairs it with smp_load_acquire() in the reader. On x86 these compile to plain accesses under TSO; on ARM64 they emit one-instruction acquire/release barriers.
Detection Methods for CVE-2026-80895
Indicators of Compromise
- Unexpected kernel oops or panic traces originating in mshv_try_assert_irq_fast() referencing NULL or unmapped addresses derived from vp_register_page.
- Kernel logs showing crashes correlated with concurrent MSHV_IRQFD registration and MSHV_CREATE_VP ioctl activity on the same vp_index.
- Processes with /dev/mshv file descriptors performing rapid, interleaved VP creation and irqfd signaling.
Detection Strategies
- Audit kernel version banners across Hyper-V root-partition Linux hosts and compare against the fixed commit hashes listed in the upstream references.
- Enable kernel lockdep and KCSAN in test environments to surface data races on pt_vp_array accesses.
- Collect dmesg and crash-dump telemetry from ARM64 root-partition hosts and correlate against the affected code paths.
Monitoring Recommendations
- Monitor ioctl usage on /dev/mshv, specifically the sequencing of MSHV_IRQFD and MSHV_CREATE_VP calls from unprivileged workloads.
- Track kernel crash frequency on ARM64 Hyper-V root-partition hosts and alert on repeated faults referencing mshv symbols.
- Ensure endpoint telemetry captures kernel module load events and kernel version metadata for inventory hygiene.
How to Mitigate CVE-2026-80895
Immediate Actions Required
- Apply the upstream kernel patches referenced by commits 062aa5d, b098dc8, and eba2bf5 from your distribution vendor.
- Prioritize patching on ARM64 hosts operating as Hyper-V root partitions, where the race is structurally reachable.
- Restrict access to /dev/mshv to trusted virtualization management components only.
Patch Information
The fix introduces smp_store_release() in mshv_partition_ioctl_create_vp() when publishing the VP pointer into pt_vp_array, and a paired smp_load_acquire() in mshv_try_assert_irq_fast(). This guarantees that all initializing stores to the VP structure are visible before any reader observes the non-NULL pointer. Patch commits are available at Git Kernel Commit 062aa5d, Git Kernel Commit b098dc8, and Git Kernel Commit eba2bf5.
Workarounds
- Where patching is not immediately possible, limit /dev/mshv device permissions to reduce the local attack surface.
- Avoid deploying vulnerable kernel builds as Hyper-V root partitions on ARM64 hardware until fixed packages are available.
- Rebuild affected kernels from source with the referenced commits cherry-picked into the local tree.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
