{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97478", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.149Z", "datePublished": "2026-09-24T16:04:20.263Z", "dateUpdated": "2026-09-24T16:04:20.263Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-24T16:04:20.263Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirt: acrn: Fix irqfd use-after-free during eventfd shutdown\n\nacrn_irqfd_deassign() and the eventfd EPOLLHUP wakeup can race and free\nthe same struct hsm_irqfd:\n\n CPU0 CPU1\n ---- ----\n eventfd_release()\n wake_up_poll(EPOLLHUP)\n hsm_irqfd_wakeup()\n queue_work(&irqfd->shutdown)\n acrn_irqfd_deassign()\n hsm_irqfd_shutdown()\n list_del_init()\n eventfd_ctx_remove_wait_queue()\n eventfd_ctx_put()\n kfree(irqfd)\n hsm_irqfd_shutdown_work()\n container_of(work, ..., shutdown)\n irqfd->vm <-- use-after-free\n\nThe deassign path freed the irqfd while a shutdown work item was\nalready queued by EPOLLHUP (or vice versa), so the work item could\nresurrect a dangling pointer through container_of().\n\nSwitch to the lifetime model used by KVM irqfds:\n\n - Deassign/deinit only deactivate the irqfd: remove it from vm->irqfds\n under irqfds_lock and queue the cleanup work.\n - hsm_irqfd_shutdown_work() becomes the sole owner that unhooks the\n eventfd waitqueue entry, drops the eventfd reference and frees the\n irqfd.\n - A new HSM_IRQFD_FLAG_SHUTDOWN bit guarded by test_and_set_bit()\n ensures the cleanup work is queued at most once, no matter how many\n of {EPOLLHUP, deassign, deinit} fire concurrently. This is safe to\n call from the waitqueue callback, which runs with wqh->lock held and\n IRQs disabled and therefore cannot take irqfds_lock.\n - acrn_irqfd_deassign() flushes vm->irqfd_wq before returning so the\n eventfd is fully detached on return. acrn_irqfd_deinit() deactivates\n every irqfd, flushes the workqueue and only then destroys it, so no\n path can queue_work() onto a torn-down workqueue.\n - acrn_irqfd_assign() now installs the eventfd waitqueue entry and\n publishes the irqfd to vm->irqfds under irqfds_lock, so the irqfd is\n never visible to deassign/deinit before its waitqueue entry is in\n place, and any EPOLLHUP that fires in the assign window queues\n cleanup work that blocks on irqfds_lock until publication is done."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/virt/acrn/irqfd.c"], "versions": [{"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "d8156aacfcabb81f52c20ef89094945434d08079", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "666c7f9e07925aa0863348f960e09bb89f8f05a3", "status": "affected", "versionType": "git"}, {"version": "0", "lessThan": "6.18.53", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/virt/acrn/irqfd.c"], "versions": [{"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d8156aacfcabb81f52c20ef89094945434d08079"}, {"url": "https://git.kernel.org/stable/c/666c7f9e07925aa0863348f960e09bb89f8f05a3"}], "title": "virt: acrn: Fix irqfd use-after-free during eventfd shutdown", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/virt/acrn/irqfd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d8156aacfcabb81f52c20ef89094945434d08079", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "666c7f9e07925aa0863348f960e09bb89f8f05a3", "status": "affected", "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "versionType": "git"}, {"lessThan": "6.18.53", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/virt/acrn/irqfd.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirt: acrn: Fix irqfd use-after-free during eventfd shutdown\n\nacrn_irqfd_deassign() and the eventfd EPOLLHUP wakeup can race and free\nthe same struct hsm_irqfd:\n\n CPU0 CPU1\n ---- ----\n eventfd_release()\n wake_up_poll(EPOLLHUP)\n hsm_irqfd_wakeup()\n queue_work(&irqfd->shutdown)\n acrn_irqfd_deassign()\n hsm_irqfd_shutdown()\n list_del_init()\n eventfd_ctx_remove_wait_queue()\n eventfd_ctx_put()\n kfree(irqfd)\n hsm_irqfd_shutdown_work()\n container_of(work, ..., shutdown)\n irqfd->vm <-- use-after-free\n\nThe deassign path freed the irqfd while a shutdown work item was\nalready queued by EPOLLHUP (or vice versa), so the work item could\nresurrect a dangling pointer through container_of().\n\nSwitch to the lifetime model used by KVM irqfds:\n\n - Deassign/deinit only deactivate the irqfd: remove it from vm->irqfds\n under irqfds_lock and queue the cleanup work.\n - hsm_irqfd_shutdown_work() becomes the sole owner that unhooks the\n eventfd waitqueue entry, drops the eventfd reference and frees the\n irqfd.\n - A new HSM_IRQFD_FLAG_SHUTDOWN bit guarded by test_and_set_bit()\n ensures the cleanup work is queued at most once, no matter how many\n of {EPOLLHUP, deassign, deinit} fire concurrently. This is safe to\n call from the waitqueue callback, which runs with wqh->lock held and\n IRQs disabled and therefore cannot take irqfds_lock.\n - acrn_irqfd_deassign() flushes vm->irqfd_wq before returning so the\n eventfd is fully detached on return. acrn_irqfd_deinit() deactivates\n every irqfd, flushes the workqueue and only then destroys it, so no\n path can queue_work() onto a torn-down workqueue.\n - acrn_irqfd_assign() now installs the eventfd waitqueue entry and\n publishes the irqfd to vm->irqfds under irqfds_lock, so the irqfd is\n never visible to deassign/deinit before its waitqueue entry is in\n place, and any EPOLLHUP that fires in the assign window queues\n cleanup work that blocks on irqfds_lock until publication is done."}], "id": "CVE-2026-97478", "lastModified": "2026-09-24T17:17:25.183", "metrics": {}, "published": "2026-09-24T17:17:25.183", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/666c7f9e07925aa0863348f960e09bb89f8f05a3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d8156aacfcabb81f52c20ef89094945434d08079"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{}