UBUNTU-CVE-2026-97478: Use After Free

In the Linux kernel, the following vulnerability has been resolved: virt: acrn: Fix irqfd use-after-free during eventfd shutdown acrnirqfddeassign() and the eventfd EPOLLHUP wakeup can race and free the same struct hsmirqfd: CPU0 CPU1 ---- ---- eventfdrelease() wakeuppoll(EPOLLHUP) hsmirqfdwakeup() queuework(&irqfd->shutdown) acrnirqfddeassign() hsmirqfdshutdown() listdelinit() eventfdctxremovewaitqueue() eventfdctxput() kfree(irqfd) hsmirqfdshutdownwork() containerof(work, ..., shutdown) irqfd->vm <-- use-after-free The deassign path freed the irqfd while a shutdown work item was already queued by EPOLLHUP (or vice versa), so the work item could resurrect a dangling pointer through containerof(). Switch to the lifetime model used by KVM irqfds: - Deassign/deinit only deactivate the irqfd: remove it from vm->irqfds under irqfdslock and queue the cleanup work. - hsmirqfdshutdownwork() becomes the sole owner that unhooks the eventfd waitqueue entry, drops the eventfd reference and frees the irqfd. - A new HSMIRQFDFLAGSHUTDOWN bit guarded by testandsetbit() ensures the cleanup work is queued at most once, no matter how many of {EPOLLHUP, deassign, deinit} fire concurrently. This is safe to call from the waitqueue callback, which runs with wqh->lock held and IRQs disabled and therefore cannot take irqfdslock. - acrnirqfddeassign() flushes vm->irqfdwq before returning so the eventfd is fully detached on return. acrnirqfddeinit() deactivates every irqfd, flushes the workqueue and only then destroys it, so no path can queuework() onto a torn-down workqueue. - acrnirqfdassign() now installs the eventfd waitqueue entry and publishes the irqfd to vm->irqfds under irqfdslock, so the irqfd is never visible to deassign/deinit before its waitqueue entry is in place, and any EPOLLHUP that fires in the assign window queues cleanup work that blocks on irqfdslock until publication is done.