Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: mshv: Fix race in mshv_irqfd_deassign mshv_irqfd_deactivate() and the hlist… (CVE-2026-80896)

The vulnerability in the Linux kernel's mshv driver stemmed from mshv_irqfd_deassign() omitting the required pt->pt_irqfds_lock during traversal of pt_irqfds_list, causing a race condition with the EPOLLHUP path in mshv_irqfd_wakeup(), which does acquire the lock before calling mshv_irqfd_deactivate(). Furthermore, mshv_irqfd_deactivate() used hlist_del() which poisons node pointers rather than resetting them, causing mshv_irqfd_is_active() to incorrectly consider nodes active. This could lead to a double hlist_del() on poisoned pointers if concurrent calls occur. The patch added spin_lock_irq/spin_unlock_irq around the list traversal in mshv_irqfd_deassign() and replaced hlist_del() with hlist_del_init() to properly mark nodes as unhashed after removal, ensuring the is_active guard works correctly.

The race condition and improper list node handling could lead to inconsistent internal kernel state in the mshv driver, potentially causing kernel instability or crashes. No direct exploit or active exploitation is known. The impact is primarily on kernel reliability and stability rather than direct privilege escalation or data exposure.

A fix has been implemented in the Linux kernel to address this issue by adding the missing locking and using a safer list deletion function. Users should apply the official kernel updates that include this patch to remediate the vulnerability. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisory for the exact fixed versions and update accordingly.