CVE-2026-97478

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> virt: acrn: Fix irqfd use-after-free during eventfd shutdown<br /> <br /> acrn_irqfd_deassign() and the eventfd EPOLLHUP wakeup can race and free<br /> the same struct hsm_irqfd:<br /> <br /> CPU0 CPU1<br /> ---- ----<br /> eventfd_release()<br /> wake_up_poll(EPOLLHUP)<br /> hsm_irqfd_wakeup()<br /> queue_work(&amp;irqfd-&gt;shutdown)<br /> acrn_irqfd_deassign()<br /> hsm_irqfd_shutdown()<br /> list_del_init()<br /> eventfd_ctx_remove_wait_queue()<br /> eventfd_ctx_put()<br /> kfree(irqfd)<br /> hsm_irqfd_shutdown_work()<br /> container_of(work, ..., shutdown)<br /> irqfd-&gt;vm irqfds<br /> under irqfds_lock and queue the cleanup work.<br /> - hsm_irqfd_shutdown_work() becomes the sole owner that unhooks the<br /> eventfd waitqueue entry, drops the eventfd reference and frees the<br /> irqfd.<br /> - A new HSM_IRQFD_FLAG_SHUTDOWN bit guarded by test_and_set_bit()<br /> ensures the cleanup work is queued at most once, no matter how many<br /> of {EPOLLHUP, deassign, deinit} fire concurrently. This is safe to<br /> call from the waitqueue callback, which runs with wqh-&gt;lock held and<br /> IRQs disabled and therefore cannot take irqfds_lock.<br /> - acrn_irqfd_deassign() flushes vm-&gt;irqfd_wq before returning so the<br /> eventfd is fully detached on return. acrn_irqfd_deinit() deactivates<br /> every irqfd, flushes the workqueue and only then destroys it, so no<br /> path can queue_work() onto a torn-down workqueue.<br /> - acrn_irqfd_assign() now installs the eventfd waitqueue entry and<br /> publishes the irqfd to vm-&gt;irqfds under irqfds_lock, so the irqfd is<br /> never visible to deassign/deinit before its waitqueue entry is in<br /> place, and any EPOLLHUP that fires in the assign window queues<br /> cleanup work that blocks on irqfds_lock until publication is done.