CVE-2026-97478: virt: acrn: Fix irqfd use-after-free during eventfd shutdown
In the Linux kernel, the following vulnerability has been resolved:
virt: acrn: Fix irqfd use-after-free during eventfd shutdown
acrnirqfddeassign() and the eventfd EPOLLHUP wakeup can race and free the same struct hsmirqfd:
CPU0 CPU1 ---- ---- eventfdrelease() wakeuppoll(EPOLLHUP) hsmirqfdwakeup() queuework(&irqfd->shutdown) acrnirqfddeassign() hsmirqfdshutdown() listdelinit() eventfdctxremovewaitqueue() eventfdctxput() kfree(irqfd) hsmirqfdshutdownwork() containerof(work, ..., shutdown) irqfd->vm <-- use-after-free
The deassign path freed the irqfd while a shutdown work item was already queued by EPOLLHUP (or vice versa), so the work item could resurrect a dangling pointer through containerof().
Switch to the lifetime model used by KVM irqfds:
- Deassign/deinit only deactivate the irqfd: remove it from vm->irqfds under irqfdslock and queue the cleanup work. - hsmirqfdshutdownwork() becomes the sole owner that unhooks the eventfd waitqueue entry, drops the eventfd reference and frees the irqfd. - A new HSMIRQFDFLAGSHUTDOWN bit guarded by testandsetbit() ensures the cleanup work is queued at most once, no matter how many of {EPOLLHUP, deassign, deinit} fire concurrently. This is safe to call from the waitqueue callback, which runs with wqh->lock held and IRQs disabled and therefore cannot take irqfdslock. - acrnirqfddeassign() flushes vm->irqfdwq before returning so the eventfd is fully detached on return. acrnirqfddeinit() deactivates every irqfd, flushes the workqueue and only then destroys it, so no path can queuework() onto a torn-down workqueue. - acrnirqfdassign() now installs the eventfd waitqueue entry and publishes the irqfd to vm->irqfds under irqfdslock, so the irqfd is never visible to deassign/deinit before its waitqueue entry is in place, and any EPOLLHUP that fires in the assign window queues cleanup work that blocks on irqfdslock until publication is done.
Affected Software
Event History
Frequently Asked Questions
What condition triggers the use-after-free?
The race occurs when an ACRN irqfd is deassigned while the associated eventfd is being released and generates an EPOLLHUP wakeup. Either path can queue shutdown handling while the other frees the same irqfd structure.
What is the practical failure mechanism?
A queued shutdown work item can later use container_of() to recover an irqfd structure that has already been freed by the deassign path. The dangling structure is then accessed through its vm member.
What does the fix change to prevent the race?
Deassignment and deinitialization now deactivate the irqfd and queue cleanup rather than freeing it directly. The shutdown worker exclusively removes the eventfd waitqueue entry, drops the eventfd reference, and frees the irqfd; a shutdown flag prevents cleanup from being queued more than once.