CVE-2026-80895

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mshv: Order pt_vp_array publish against irqfd assertion path

mshv_partition_ioctl_create_vp() initialises a VP struct (allocations,

mutex_init, init_waitqueue_head, page mappings) and then publishes the

pointer into partition->pt_vp_array. Several ISR paths read this array

locklessly: the intercept ISR, the two scheduler ISRs, and

mshv_try_assert_irq_fast() on the irqfd fast path.

Of these, only mshv_try_assert_irq_fast() can structurally race the

publish. It runs from an eventfd waker without holding pt_mutex, and

MSHV_IRQFD does not require the target lapic_apic_id (== vp_index) to

refer to an existing VP at registration time. A user can therefore

register an irqfd targeting a yet-to-be-created VP, then trigger

mshv_try_assert_irq_fast() concurrently with MSHV_CREATE_VP for the

same index. On weakly-ordered architectures the reader can observe a

non-NULL pointer in pt_vp_array before the initialising stores to

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References