UBUNTU-CVE-2026-98464: Use After Free

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during teardown The non-Sstc hrtimer callback clears nextset before its final uses of the enclosing vCPU. If teardown observes nextset as false while the callback is still running, kvmriscvvcputimercancel() skips hrtimercancel() and kvmdestroyvcpus() can free the vCPU before the callback enters kvmriscvvcpusetinterrupt(). A guest can arm the timer with SBI TIME and request shutdown with SBI legacy shutdown or SRST. A VMM that honors KVMEXITSYSTEMEVENT and destroys the VM supplies the teardown side of the race; no post-launch host ioctl is needed to arm or request teardown. On upstream master 62cc90241548, generic KASAN reported: BUG: KASAN: slab-use-after-free in dorawspinlock Write of size 4 at addr ff60000005e58898 kvmriscvvcpusetinterrupt kvmriscvvcpuhrtimerexpired hrtimerrunqueues hrtimerinterrupt The object was allocated by KVMCREATEVCPU and freed concurrently by: kvmdestroyvcpus kvmarchdestroyvm kvmdestroyvm fput For deterministic validation, I added mdelay(1000) immediately after the existing nextset = false assignment. This only widens the existing post-clear callback window. A no-delay trace build naturally reached the callback-after-teardown-start/before-deinit ordering in 12 of 200 runs, but 1,500 stock-kernel stress iterations did not produce a KASAN report, so natural reproduction is timing-sensitive. Always invoke hrtimercancel() for an initialized timer. Preserve the existing -EINVAL result when the timer is no longer set, but only after synchronizing with a running callback. With this patch, hrtimercancel() blocked for the full widened callback window before vCPU destruction. KASAN reported no error in 100 fixed-and-widened runs or 200 fix-only timing-sweep runs.