CVE-2026-64073

In the Linux kernel, the following vulnerability has been resolved:

irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT

On PREEMPT_RT, non-HARD irq_work runs in per-CPU kthreads via

run_irq_workd(), so irq_work_sync() uses rcuwait() to wait for BUSY==0.

After irq_work_single() clears BUSY via atomic_cmpxchg(), it still

dereferences @work for irq_work_is_hard() and rcuwait_wake_up().

An irq_work_sync() caller on another CPU that enters after BUSY is cleared

can observe BUSY==0 immediately, return, and free the work before those

accesses complete — causing a use-after-free.

Fix this by wrapping run_irq_workd() in guard(rcu)() so that the entire

irq_work_single() execution is within an RCU read-side critical

section. Then add synchronize_rcu() in irq_work_sync() after

rcuwait_wait_event() to ensure the caller waits for the RCU grace period

before returning, preventing premature frees.