CVE-2026-97478 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
virt: acrn: Fix irqfd use-after-free during eventfd shutdown
acrn_irqfd_deassign() and the eventfd EPOLLHUP wakeup can race and free the same struct hsm_irqfd:
CPU0 CPU1 ---- ---- eventfd_release() wake_up_poll(EPOLLHUP) hsm_irqfd_wakeup() queue_work(&irqfd->shutdown) acrn_irqfd_deassign() hsm_irqfd_shutdown() list_del_init() eventfd_ctx_remove_wait_queue() eventfd_ctx_put() kfree(irqfd) hsm_irqfd_shutdown_work() container_of(work, ..., shutdown) irqfd->vm <-- use-after-free
The deassign path freed the irqfd while a shutdown work item was already queued by EPOLLHUP (or vice versa), so the work item could resurrect a dangling pointer through container_of().
Switch to the lifetime model used by KVM irqfds:
- Deassign/deinit only deactivate the irqfd: remove it from vm->irqfds under irqfds_lock and queue the cleanup work. - hsm_irqfd_shutdown_work() becomes the sole owner that unhooks the eventfd waitqueue entry, drops the eventfd reference and frees the irqfd. - A new HSM_IRQFD_FLAG_SHUTDOWN bit guarded by test_and_set_bit() ensures the cleanup work is queued at most once, no matter how many of {EPOLLHUP, deassign, deinit} fire concurrently. This is safe to
call from the waitqueue callback, which runs with wqh->lock held and IRQs disabled and therefore cannot take irqfds_lock. - acrn_irqfd_deassign() flushes vm->irqfd_wq before returning so the eventfd is fully detached on return. acrn_irqfd_deinit() deactivates every irqfd, flushes the workqueue and only then destroys it, so no path can queue_work() onto a torn-down workqueue. - acrn_irqfd_assign() now installs the eventfd waitqueue entry and publishes the irqfd to vm->irqfds under irqfds_lock, so the irqfd is never visible to deassign/deinit before its waitqueue entry is in place, and any EPOLLHUP that fires in the assign window queues cleanup work that blocks on irqfds_lock until publication is done.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The Linux kernel vulnerability identified as a use-after-free condition within the ACRN virtualization subsystem stems from a race condition during the shutdown of event file descriptors. Specifically, the functions acrn_irqfd_deassign and the EPOLLHUP wakeup mechanism triggered by eventfd_release can execute concurrently, leading to both attempting to free the same struct hsm_irqfd instance. This concurrency issue arises because one execution path may deallocate memory while another path, such as a queued shutdown work item, attempts to access that memory through pointer dereferencing operations like container_of. The core technical flaw lies in the lack of synchronization between the deassignment logic and the event-driven cleanup processes, allowing a dangling pointer to be resurrected and used after its underlying memory has been released by another thread or interrupt context.
From an operational perspective, this vulnerability poses significant risks including kernel panics, system instability, and potential privilege escalation if an attacker can trigger the race condition through crafted virtual machine configurations or guest OS interactions. The use-after-free scenario allows for arbitrary code execution possibilities depending on how the freed memory is reallocated and accessed by subsequent operations within the hypervisor layer. This type of flaw compromises the integrity and availability of the host system running ACRN, which serves as a Type-1 hypervisor designed to support multiple operating systems simultaneously with high performance requirements.
The remediation strategy involves restructuring the lifetime model for irqfd objects to align with established patterns used in KVM implementations. The fix introduces a clear separation between deactivation and actual resource cleanup. Deassign or deinit operations now only deactivate the irqfd by removing it from the vm->irqfds list under proper locking mechanisms and queueing a dedicated shutdown work item rather than immediately freeing resources. This ensures that all pending events are handled before any memory is released, preventing access to freed structures.
A critical component of this fix is the introduction of a new flag HSM_IRQFD_FLAG_SHUTDOWN which is managed using atomic test_and_set_bit operations. This mechanism guarantees that cleanup work is queued exactly once regardless of how many concurrent triggers such as EPOLLHUP signals or deassign calls occur simultaneously. By guarding the queuing process with an atomic bit operation, the code prevents duplicate shutdown requests and ensures thread-safe execution even when multiple events fire concurrently from different contexts including waitqueue callbacks where irqfds_lock cannot be taken due to IRQs being disabled.
Furthermore, the implementation enforces strict ordering guarantees through work queue flushing mechanisms. The acrn_irqfd_deassign function now flushes vm->irqfd_wq before returning, ensuring that all pending shutdown tasks complete and event file descriptors are fully detached prior to any further operations on those resources. Similarly, acrn_irq_fd_deinit deactivates every irqfd, flushes the associated workqueue, and only then proceeds with destruction of the queue itself. This prevents scenarios where new work items could be queued onto a torn-down or invalid workqueue structure that no longer exists in memory.
The assignment path has also been hardened to prevent visibility issues during initialization. acrn_irqfd_assign now installs the event file descriptor waitqueue entry and publishes the irqfd object to vm->irqfds under the protection of irqfds_lock. This sequencing ensures that an irqfd is never visible to deassignment or deinitialization routines until its internal state including waitqueue entries is fully established. Any EPOLLHUP events occurring during this assignment window will queue cleanup work that blocks on acquiring irqfds_lock, thereby waiting for publication completion before attempting any operations against the newly created structure.
This vulnerability aligns with CWE-416 which describes use-after-free conditions resulting from improper management of memory allocation and deallocation lifecycles in concurrent environments. In terms of attack vector classification under MITRE ATT&CK frameworks this relates to techniques involving exploitation of race conditions within system-level components often categorized under privilege escalation or denial-of-service vectors depending on the ultimate outcome achieved by exploiting the flaw. The fix demonstrates best practices for handling shared resources across multiple execution contexts including interrupt handlers and process context threads ensuring consistent state transitions without exposing intermediate inconsistent states that could be exploited maliciously.