CVE-2026-97478virt: acrn: Fix irqfd use-after-free during eventfd shutdown

Description

In the Linux kernel, the following vulnerability has been resolved: virt: acrn: Fix irqfd use-after-free during eventfd shutdown acrn_irqfd_deassign() and the eventfd EPOLLHUP wakeup can race and free the same struct hsm_irqfd: CPU0 CPU1 ---- ---- eventfd_release() wake_up_poll(EPOLLHUP) hsm_irqfd_wakeup() queue_work(&irqfd->shutdown) acrn_irqfd_deassign() hsm_irqfd_shutdown() list_del_init() eventfd_ctx_remove_wait_queue() eventfd_ctx_put() kfree(irqfd) hsm_irqfd_shutdown_work() container_of(work, ..., shutdown) irqfd->vm <-- use-after-free The deassign path freed the irqfd while a shutdown work item was already queued by EPOLLHUP (or vice versa), so the work item could resurrect a dangling pointer through container_of(). Switch to the lifetime model used by KVM irqfds: - Deassign/deinit only deactivate the irqfd: remove it from vm->irqfds under irqfds_lock and queue the cleanup work. - hsm_irqfd_shutdown_work() becomes the sole owner that unhooks the eventfd waitqueue entry, drops the eventfd reference and frees the irqfd. - A new HSM_IRQFD_FLAG_SHUTDOWN bit guarded by test_and_set_bit() ensures the cleanup work is queued at most once, no matter how many of {EPOLLHUP, deassign, deinit} fire concurrently. This is safe to call from the waitqueue callback, which runs with wqh->lock held and IRQs disabled and therefore cannot take irqfds_lock. - acrn_irqfd_deassign() flushes vm->irqfd_wq before returning so the eventfd is fully detached on return. acrn_irqfd_deinit() deactivates every irqfd, flushes the workqueue and only then destroys it, so no path can queue_work() onto a torn-down workqueue. - acrn_irqfd_assign() now installs the eventfd waitqueue entry and publishes the irqfd to vm->irqfds under irqfds_lock, so the irqfd is never visible to deassign/deinit before its waitqueue entry is in place, and any EPOLLHUP that fires in the assign window queues cleanup work that blocks on irqfds_lock until publication is done.

Timeline

Scores

EPSS (exploitation in 30 days)

0.13% · top 98% of all CVEs (14 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.

Affected products

• Linux · Linux

  • affected aa3b483ff1d71c50b33db154048dff9a8f08ac71 – < dccf23a72a6c5ec8d9eab2a7f98e186af6eaff48
  • affected aa3b483ff1d71c50b33db154048dff9a8f08ac71 – < 6e9e007ee1dfb54bc2d070550308077ec28dbaec
  • affected aa3b483ff1d71c50b33db154048dff9a8f08ac71 – < 0e1152f689847b9db2f05454775d34610c1424c2
  • affected aa3b483ff1d71c50b33db154048dff9a8f08ac71 – < d8156aacfcabb81f52c20ef89094945434d08079
  • affected aa3b483ff1d71c50b33db154048dff9a8f08ac71 – < 666c7f9e07925aa0863348f960e09bb89f8f05a3

• Linux · Linux

  • affected 5.12
  • unaffected < 5.12
  • unaffected 6.1.191 – ≤ 6.1.*
  • unaffected 6.6.160 – ≤ 6.6.*
  • unaffected 6.12.114 – ≤ 6.12.*
  • unaffected 6.18.53 – ≤ 6.18.*
  • unaffected 7.2 – ≤ *

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-86076 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-97478](https://cveledger.app/badge/CVE-2026-97478.svg)](https://cveledger.app/cve/CVE-2026-97478)

Record last updated 30 Oct 2026, 12:36 UTC.