# CVE-2026-80896: mshv: Fix race in mshv_irqfd_deassign

> A race condition in the Linux kernel's mshv driver allows local attackers to trigger a double free or use-after-free, potentially leading to privilege escalation or system crash.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 4 Sep 2026
- **Updated:** 4 Sep 2026
- **Also known as:** BELL-CVE-2026-80896, DEBIAN-CVE-2026-80896, GHSA-322j-r4fq-pwx8, UBUNTU-CVE-2026-80896

## What is CVE-2026-80896?

CVE-2026-80896 is a vulnerability in Linux, published on 4 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

mshv: Fix race in mshv_irqfd_deassign

mshv_irqfd_deactivate() and the hlist traversal of pt_irqfds_list
require pt->pt_irqfds_lock to be held, but mshv_irqfd_deassign()
omits it. This races with the EPOLLHUP path in mshv_irqfd_wakeup(),
which does take the lock before calling mshv_irqfd_deactivate().

Additionally, mshv_irqfd_deactivate() uses hlist_del() which poisons
the node pointers rather than resetting them. Since
mshv_irqfd_is_active() relies on hlist_unhashed() (checks pprev ==
NULL), a poisoned node still appears active. If a concurrent path calls
mshv_irqfd_deactivate() again on the same irqfd, the guard fails to
prevent a double hlist_del() on poisoned pointers.

Fix both issues:
- Add the missing spin_lock_irq/spin_unlock_irq around the list
  traversal in mshv_irqfd_deassign(), matching mshv_irqfd_release().
- Use hlist_del_init() instead of hlist_del() so the node is properly
  marked as unhashed after removal, making the is_active guard reliable.

## Which versions are affected by CVE-2026-80896?


## How do I fix CVE-2026-80896?

Apply the vendor's patch.

## Is CVE-2026-80896 being exploited?

There is no known exploitation of CVE-2026-80896 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-80896 and fix it if it is affected.

What it is: CVE-2026-80896 is a vulnerability in Linux, published on 4 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-80896 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-80896/ (Markdown: https://insights.sbomify.com/CVE-2026-80896/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-80896
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-80896
- OSV: https://osv.dev/vulnerability/CVE-2026-80896

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-80896/
Summaries are generated and may contain mistakes; the official description above is the record.