virt: acrn: Fix irqfd use-after-free during eventfd shutdown

Summary

In the Linux kernel, the following vulnerability has been resolved: virt: acrn: Fix irqfd use-after-free during eventfd shutdown acrn_irqfd_deassign() and the eventfd EPOLLHUP wakeup can race and free the same struct hsm_irqfd: CPU0 CPU1 ---- ---- eventfd_release() wake_up_poll(EPOLLHUP) hsm_irqfd_wakeup() queue_work(&irqfd->shutdown) acrn_irqfd_deassign() hsm_irqfd_shutdown() list_del_init() eventfd_ctx_remove_wait_queue() eventfd_ctx_put() kfree(irqfd) hsm_irqfd_shutdown_work() container_of(work, ..., shutdown) irqfd->vm <-- use-after-free The deassign path freed the irqfd while a shutdown work item was already queued by EPOLLHUP (or vice versa), so the work item could resurrect a dangling pointer through container_of(). Switch to the lifetime model used by KVM irqfds: • Deassign/deinit only deactivate the irqfd: remove it from vm->irqfds under irqfds_lock and queue the cleanup work. • hsm_irqfd_shutdown_work() becomes the sole owner that unhooks the eventfd waitqueue entry, drops the eventfd reference and frees the irqfd. • A new HSM_IRQFD_FLAG_SHUTDOWN bit guarded by test_and_set_bit() ensures the cleanup work is queued at most once, no matter how many of {EPOLLHUP, deassign, deinit} fire concurrently. This is safe to call from the waitqueue callback, which runs with wqh->lock held and IRQs disabled and therefore cannot take irqfds_lock. • acrn_irqfd_deassign() flushes vm->irqfd_wq before returning so the eventfd is fully detached on return. acrn_irqfd_deinit() deactivates every irqfd, flushes the workqueue and only then destroys it, so no path can queue_work() onto a torn-down workqueue. • acrn_irqfd_assign() now installs the eventfd waitqueue entry and publishes the irqfd to vm->irqfds under irqfds_lock, so the irqfd is never visible to deassign/deinit before its waitqueue entry is in place, and any EPOLLHUP that fires in the assign window queues cleanup work that blocks on irqfds_lock until publication is done.

Timeline

1. Sep 24, 2026, 4:04 PM UTCCVE published
2. Oct 21, 2026, 12:52 PM UTCRecord last updated

Affected versions

• Linux Linux

  From aa3b483ff1d71c50b33db154048dff9a8f08ac71 · fixed in 6e9e007ee1dfb54bc2d070550308077ec28dbaec; From aa3b483ff1d71c50b33db154048dff9a8f08ac71 · fixed in 0e1152f689847b9db2f05454775d34610c1424c2; From aa3b483ff1d71c50b33db154048dff9a8f08ac71 · fixed in d8156aacfcabb81f52c20ef89094945434d08079; From aa3b483ff1d71c50b33db154048dff9a8f08ac71 · fixed in 666c7f9e07925aa0863348f960e09bb89f8f05a3

• Linux Linux

  5.12

• KernelLinux

  From 5.12.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.114; From 6.13.0 · fixed in 6.18.53

References 4