CVE-2026-80895

In the Linux kernel, the following vulnerability has been resolved:

mshv: Order ptvparray publish against irqfd assertion path

mshvpartitionioctlcreatevp() initialises a VP struct (allocations, mutexinit, initwaitqueuehead, page mappings) and then publishes the pointer into partition->ptvparray. Several ISR paths read this array locklessly: the intercept ISR, the two scheduler ISRs, and mshvtryassertirq_fast() on the irqfd fast path.

Of these, only mshvtryassertirqfast() can structurally race the publish. It runs from an eventfd waker without holding ptmutex, and MSHVIRQFD does not require the target lapicapicid (== vpindex) to refer to an existing VP at registration time. A user can therefore register an irqfd targeting a yet-to-be-created VP, then trigger mshvtryassertirqfast() concurrently with MSHVCREATEVP for the same index. On weakly-ordered architectures the reader can observe a non-NULL pointer in ptvparray before the initialising stores to the VP struct become visible, leading to use of partially-initialised fields (e.g. vpregister_page).

The other ISR readers cannot reach this race: the hypervisor will not generate intercept or scheduler messages for a VP that has never been told to run, and the user can only call MSHVRUNVP on the VP fd returned by MSHVCREATEVP, which by construction is returned after the publish. Leave those readers as plain loads.

Use smpstorerelease() in mshvpartitionioctlcreatevp() to publish the pointer, and pair it with smploadacquire() in mshvtryassertirqfast(). On x86 these compile to plain accesses under TSO; on ARM64 they emit one-instruction acquire/release barriers, acceptable on this fast path.

The destroy-side path (destroypartition() clearing ptvp_array[i] to NULL after kfree(vp)) has a separate ordering and lifetime concern that is out of scope here.