CVE-2026-80896 Overview
CVE-2026-80896 is a race condition in the Linux kernel's Microsoft Hypervisor (mshv) subsystem. The flaw exists in mshv_irqfd_deassign(), which traverses pt_irqfds_list without holding the required pt->pt_irqfds_lock. This creates a race against the EPOLLHUP path in mshv_irqfd_wakeup(), which correctly acquires the lock before calling mshv_irqfd_deactivate(). A secondary issue involves the use of hlist_del(), which poisons node pointers instead of resetting them, defeating the mshv_irqfd_is_active() guard and allowing a double hlist_del() on poisoned pointers.
Critical Impact
Concurrent execution paths can trigger a double-removal of the same irqfd node, leading to kernel memory corruption or crash within the mshv virtualization stack.
Affected Products
- Linux kernel (mshv subsystem)
- Distributions shipping the Microsoft Hypervisor root partition driver
- Systems running the mshv guest/root partition interface
Discovery Timeline
- 2026-09-04 - CVE-2026-80896 published to NVD
- 2026-09-04 - Last updated in NVD database
Technical Details for CVE-2026-80896
Vulnerability Analysis
The vulnerability resides in the mshv (Microsoft Hypervisor) irqfd management code. Irqfds allow userspace to inject interrupts into a guest partition through an eventfd descriptor. Each partition maintains an hlist of active irqfds protected by pt->pt_irqfds_lock.
The function mshv_irqfd_deassign() walks pt_irqfds_list and calls mshv_irqfd_deactivate() on matching entries without acquiring the lock. In parallel, mshv_irqfd_wakeup() handling the EPOLLHUP event correctly holds the lock while calling the same deactivate routine. This asymmetric locking permits concurrent access to the shared list.
Compounding the race, mshv_irqfd_deactivate() calls hlist_del() to remove entries. hlist_del() sets the node pointers to poison values (LIST_POISON1, LIST_POISON2) rather than nulling them. The guard function mshv_irqfd_is_active() uses hlist_unhashed(), which returns true only when pprev == NULL. A poisoned node therefore still appears active, allowing a second deactivation path to invoke hlist_del() on already-poisoned pointers.
Root Cause
The root cause is twofold: missing lock acquisition in mshv_irqfd_deassign() around the hlist traversal, and use of hlist_del() instead of hlist_del_init() in mshv_irqfd_deactivate(). Together these defects create a classic race condition [CWE-362] combined with an unreliable state guard that fails to prevent duplicate list removal.
Attack Vector
Exploitation requires local access to a system exposing the mshv interface, typically a privileged process managing hypervisor partitions. An attacker with the ability to issue concurrent irqfd assign/deassign ioctls against the same partition can trigger the race. Successful exploitation produces kernel memory corruption on poisoned pointer dereference, resulting in denial of service or potentially further memory safety impact.
No public proof-of-concept has been published. The fix landed in the upstream kernel through commits 0762262a, 4529a41a, and 72a90ce4.
Detection Methods for CVE-2026-80896
Indicators of Compromise
- Kernel oops or panic traces referencing mshv_irqfd_deactivate, hlist_del, or LIST_POISON values in dmesg output.
- Repeated crashes of virtual machine management processes interacting with /dev/mshv under heavy irqfd churn.
- Unexpected VM partition termination correlated with concurrent ioctl activity from management daemons.
Detection Strategies
- Monitor kernel logs for general protection fault or BUG: entries whose backtrace includes mshv irqfd symbols.
- Track abnormal exits of hypervisor management services and correlate them with kernel crash telemetry.
- Audit workloads issuing high volumes of MSHV_IRQFD ioctls with deassign operations against the same partition.
Monitoring Recommendations
- Ingest /var/log/kern.log and dmesg output into centralized logging for pattern matching on mshv stack traces.
- Enable kernel crash dump collection (kdump) on hosts running mshv to capture forensic evidence of exploitation attempts.
- Alert on repeated partition creation and teardown activity from non-standard user contexts.
How to Mitigate CVE-2026-80896
Immediate Actions Required
- Apply the upstream kernel patches referenced by commits 0762262a, 4529a41a, and 72a90ce4 from the stable kernel tree.
- Update to a distribution kernel that incorporates the mshv irqfd locking fix once vendors publish rebuilt packages.
- Restrict access to /dev/mshv to trusted virtualization management users and services only.
Patch Information
The fix adds spin_lock_irq(&pt->pt_irqfds_lock) and spin_unlock_irq() around the list traversal in mshv_irqfd_deassign() to match the locking discipline used in mshv_irqfd_release(). It also replaces hlist_del() with hlist_del_init() in mshv_irqfd_deactivate(), ensuring nodes are marked unhashed after removal and making the mshv_irqfd_is_active() guard reliable. Refer to the Kernel Git Commit 0762262a, Kernel Git Commit 4529a41a, and Kernel Git Commit 72a90ce4 for the exact source changes.
Workarounds
- Limit concurrent irqfd deassign operations from userspace management stacks until patched kernels are deployed.
- Disable or unload the mshv driver on hosts that do not require the Microsoft Hypervisor root partition interface.
- Apply mandatory access control policies (SELinux, AppArmor) restricting which processes may open /dev/mshv.
# Verify running kernel version and mshv module status
uname -r
lsmod | grep mshv
# Restrict device node permissions to root and the virtualization group
chown root:kvm /dev/mshv
chmod 0660 /dev/mshv
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
