CVE-2026-97478

In the Linux kernel, the following vulnerability has been resolved:

virt: acrn: Fix irqfd use-after-free during eventfd shutdown

acrn_irqfd_deassign() and the eventfd EPOLLHUP wakeup can race and free

the same struct hsm_irqfd:

CPU0 CPU1

---- ----

eventfd_release()

wake_up_poll(EPOLLHUP)

hsm_irqfd_wakeup()

queue_work(&irqfd->shutdown)

acrn_irqfd_deassign()

hsm_irqfd_shutdown()

list_del_init()

eventfd_ctx_remove_wait_queue()

eventfd_ctx_put()

kfree(irqfd)

hsm_irqfd_shutdown_work()

container_of(work, ..., shutdown)

irqfd->vm <-- use-after-free

The deassign path freed the irqfd while a shutdown work item was

already queued by EPOLLHUP (or vice versa), so the work item could

resurrect a dangling pointer through container_of().

Switch to the lifetime model used by KVM irqfds:

- Deassign/deinit only deactivate the irqfd: remove it from vm->irqfds

under irqfds_lock and queue the cleanup work.

- hsm_irqfd_shutdown_work() becomes the sole owner that unhooks the

eventfd waitqueue entry, drops the eventfd reference and frees the

irqfd.

- A new HSM_IRQFD_FLAG_SHUTDOWN bit guarded by test_and_set_bit()

ensures the cleanup work is queued at most once, no matter how many

of {EPOLLHUP, deassign, deinit} fire concurrently. This is safe to

call from the waitqueue callback, which runs with wqh->lock held and

IRQs disabled and therefore cannot take irqfds_lock.

- acrn_irqfd_deassign() flushes vm->irqfd_wq before returning so the

eventfd is fully detached on return. acrn_irqfd_deinit() deactivates

every irqfd, flushes the workqueue and only then destroys it, so no

path can queue_work() onto a torn-down workqueue.

- acrn_irqfd_assign() now installs the eventfd waitqueue entry and

publishes the irqfd to vm->irqfds under irqfds_lock, so the irqfd is

never visible to deassign/deinit before its waitqueue entry is in

place, and any EPOLLHUP that fires in the assign window queues

cleanup work that blocks on irqfds_lock until publication is done.