{"id":"AZL-103679","summary":"CVE-2026-97478 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirt: acrn: Fix irqfd use-after-free during eventfd shutdown\n\nacrn_irqfd_deassign() and the eventfd EPOLLHUP wakeup can race and free\nthe same struct hsm_irqfd:\n\n  CPU0                                 CPU1\n  ----                                 ----\n  eventfd_release()\n    wake_up_poll(EPOLLHUP)\n      hsm_irqfd_wakeup()\n        queue_work(&irqfd-\u003eshutdown)\n                                       acrn_irqfd_deassign()\n                                         hsm_irqfd_shutdown()\n                                           list_del_init()\n                                           eventfd_ctx_remove_wait_queue()\n                                           eventfd_ctx_put()\n                                         kfree(irqfd)\n  hsm_irqfd_shutdown_work()\n    container_of(work, ..., shutdown)\n    irqfd-\u003evm                  \u003c-- use-after-free\n\nThe deassign path freed the irqfd while a shutdown work item was\nalready queued by EPOLLHUP (or vice versa), so the work item could\nresurrect a dangling pointer through container_of().\n\nSwitch to the lifetime model used by KVM irqfds:\n\n - Deassign/deinit only deactivate the irqfd: remove it from vm-\u003eirqfds\n   under irqfds_lock and queue the cleanup work.\n - hsm_irqfd_shutdown_work() becomes the sole owner that unhooks the\n   eventfd waitqueue entry, drops the eventfd reference and frees the\n   irqfd.\n - A new HSM_IRQFD_FLAG_SHUTDOWN bit guarded by test_and_set_bit()\n   ensures the cleanup work is queued at most once, no matter how many\n   of {EPOLLHUP, deassign, deinit} fire concurrently.  This is safe to\n   call from the waitqueue callback, which runs with wqh-\u003elock held and\n   IRQs disabled and therefore cannot take irqfds_lock.\n - acrn_irqfd_deassign() flushes vm-\u003eirqfd_wq before returning so the\n   eventfd is fully detached on return.  acrn_irqfd_deinit() deactivates\n   every irqfd, flushes the workqueue and only then destroys it, so no\n   path can queue_work() onto a torn-down workqueue.\n - acrn_irqfd_assign() now installs the eventfd waitqueue entry and\n   publishes the irqfd to vm-\u003eirqfds under irqfds_lock, so the irqfd is\n   never visible to deassign/deinit before its waitqueue entry is in\n   place, and any EPOLLHUP that fires in the assign window queues\n   cleanup work that blocks on irqfds_lock until publication is done.","modified":"2026-09-25T14:16:24.787601387Z","published":"2026-09-24T17:17:25Z","upstream":["CVE-2026-97478"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97478"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-103679.json"}}],"schema_version":"1.9.0"}