Executive brief
The Linux kernel's Hyper-V mshv driver contains a race condition in the interrupt event file descriptor deassignment logic. The vulnerability allows concurrent code paths to improperly access and double-delete data structures without proper synchronization, potentially leading to memory corruption or a kernel crash when interrupt event file descriptors are rapidly created and destroyed.
Technical details
A race condition exists in mshv_irqfd_deassign() in drivers/hv/mshv_eventfd.c where hlist traversal of pt_irqfds_list is performed without holding the required pt->pt_irqfds_lock spinlock, while a competing code path (EPOLLHUP in mshv_irqfd_wakeup()) does hold the lock before calling mshv_irqfd_deactivate(). Additionally, mshv_irqfd_deactivate() uses hlist_del() which poisons node pointers without resetting them; since mshv_irqfd_is_active() relies on checking pprev == NULL, a poisoned node still appears active and can be double-deleted. The fix adds spin_lock_irq/spin_unlock_irq around list traversal in mshv_irqfd_deassign() and replaces hlist_del() with hlist_del_init() to properly mark removed nodes as unhashed. No user interaction is required; the race requires only concurrent kernel code execution.
Affected products
- Linux Linux Kernel all versions with mshv driver (from commit 621191d709b14 onwards)
Timeline
- 2026-05-07: other: Patch authored
- 2026-07-31: patched: Merged into Linux mainline
- 2026-09-04: advisory: CVE-2026-80896 published