---
id: CVE-2026-97478
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  virt: acrn: Fix irqfd use-after-free during eventfd shutdown

  acrn_irqfd_deassign() and the eventfd EPOLLHUP wakeup can race and free
  the same struct hsm_irqfd:

    CPU0…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  virt: acrn: Fix irqfd use-after-free during eventfd shutdown

  acrn_irqfd_deassign() and the eventfd EPOLLHUP wakeup can race and free
  the same struct hsm_irqfd:

    CPU0…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    d8156aacfcabb81f52c20ef89094945434d08079
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    666c7f9e07925aa0863348f960e09bb89f8f05a3
  - Linux < 6.18.53
  - Linux (all versions)
published: '2026-09-24'
updated: '2026-09-28'
sourceUpdated: '2026-09-28T06:16:33.703'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97478'
references:
  - url: 'https://git.kernel.org/stable/c/666c7f9e07925aa0863348f960e09bb89f8f05a3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d8156aacfcabb81f52c20ef89094945434d08079'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97478.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-97478'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2540419'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-97478'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97478'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97478.mbox
  - url: 'https://git.kernel.org/stable/c/6e9e007ee1dfb54bc2d070550308077ec28dbaec'
  - url: 'https://git.kernel.org/stable/c/0e1152f689847b9db2f05454775d34610c1424c2'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00125
epssPercentile: 0.02228
ingestedAt: '2026-09-24T16:47:15.871Z'
cwe:
  - CWE-825
scores:
  nvd: 7.8
  vendor: 5.5
  cna: 7.8
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

virt: acrn: Fix irqfd use-after-free during eventfd shutdown

acrn_irqfd_deassign() and the eventfd EPOLLHUP wakeup can race and free
the same struct hsm_irqfd:

  CPU0                                 CPU1
  ----                                 ----
  eventfd_release()
    wake_up_poll(EPOLLHUP)
      hsm_irqfd_wakeup()
        queue_work(&irqfd->shutdown)
                                       acrn_irqfd_deassign()
                                         hsm_irqfd_shutdown()
                                           list_del_init()
                                           eventfd_ctx_remove_wait_queue()
                                           eventfd_ctx_put()
                                         kfree(irqfd)
  hsm_irqfd_shutdown_work()
    container_of(work, ..., shutdown)
    irqfd->vm                  <-- use-after-free

The deassign path freed the irqfd while a shutdown work item was
already queued by EPOLLHUP (or vice versa), so the work item could
resurrect a dangling pointer through container_of().

Switch to the lifetime model used by KVM irqfds:

 - Deassign/deinit only deactivate the irqfd: remove it from vm->irqfds
   under irqfds_lock and queue the cleanup work.
 - hsm_irqfd_shutdown_work() becomes the sole owner that unhooks the
   eventfd waitqueue entry, drops the eventfd reference and frees the
   irqfd.
 - A new HSM_IRQFD_FLAG_SHUTDOWN bit guarded by test_and_set_bit()
   ensures the cleanup work is queued at most once, no matter how many
   of {EPOLLHUP, deassign, deinit} fire concurrently.  This is safe to
   call from the waitqueue callback, which runs with wqh->lock held and
   IRQs disabled and therefore cannot take irqfds_lock.
 - acrn_irqfd_deassign() flushes vm->irqfd_wq before returning so the
   eventfd is fully detached on return.  acrn_irqfd_deinit() deactivates
   every irqfd, flushes the workqueue and only then destroys it, so no
   path can queue_work() onto a torn-down workqueue.
 - acrn_irqfd_assign() now installs the eventfd waitqueue entry and
   publishes the irqfd to vm->irqfds under irqfds_lock, so the irqfd is
   never visible to deassign/deinit before its waitqueue entry is in
   place, and any EPOLLHUP that fires in the assign window queues
   cleanup work that blocks on irqfds_lock until publication is done.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-29 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97478.json)