Executive brief
A race condition exists in the Linux kernel's Microsoft Hyper-V (mshv) virtualization module during virtual processor creation. An attacker could trigger concurrent creation of a virtual processor while sending interrupt signals to it, potentially causing the system to access uninitialized memory structures. This could lead to system instability or information disclosure on affected virtualization hosts.
Technical details
This vulnerability is a race condition (CWE-362) in the mshv_partition_ioctl_create_vp() function where a VP (virtual processor) struct is initialized but published to pt_vp_array without proper synchronization. The mshv_try_assert_irq_fast() function can read this array locklessly from an eventfd waker context, creating a window where readers observe a non-NULL pointer before the VP struct's initialization stores become visible on weakly-ordered architectures like ARM64. An attacker can register an irqfd targeting a not-yet-created VP and trigger the fast path concurrently with VP creation, causing use of partially-initialized fields such as vp_register_page. The fix uses smp_store_release() and smp_load_acquire() barriers to ensure proper ordering; on x86 (TSO) these are no-ops, but on ARM64 they add acquire/release barriers. The vulnerability requires local access and precise timing but no authentication.
Affected products
- Linux Linux kernel versions with mshv module prior to fix
Timeline
- 2026-09-04: disclosed
- 2026-09-04: patched: Fix applied via smp_store_release/smp_load_acquire synchronization