Description

In the Linux kernel, the following vulnerability has been resolved: virt: acrn: Fix irqfd use-after-free during eventfd shutdown acrn_irqfd_deassign() and the eventfd EPOLLHUP wakeup can race and free the same struct hsm_irqfd: CPU0 CPU1 ---- ---- eventfd_release() wake_up_poll(EPOLLHUP) hsm_irqfd_wakeup() queue_work(&irqfd->shutdown) acrn_irqfd_deassign() hsm_irqfd_shutdown() list_del_init() eventfd_ctx_remove_wait_queue() eventfd_ctx_put() kfree(irqfd) hsm_irqfd_shutdown_work() container_of(work, ..., shutdown) irqfd->vm <-- use-after-free The deassign path freed the irqfd while a shutdown work item was already queued by EPOLLHUP (or vice versa), so the work item could resurrect a dangling pointer through container_of(). Switch to the lifetime model used by KVM irqfds: - Deassign/deinit only deactivate the irqfd: remove it from vm->irqfds under irqfds_lock and queue the cleanup work. - hsm_irqfd_shutdown_work() becomes the sole owner that unhooks the eventfd waitqueue entry, drops the eventfd reference and frees the irqfd. - A new HSM_IRQFD_FLAG_SHUTDOWN bit guarded by test_and_set_bit() ensures the cleanup work is queued at most once, no matter how many of {EPOLLHUP, deassign, deinit} fire concurrently. This is safe to call from the waitqueue callback, which runs with wqh->lock held and IRQs disabled and therefore cannot take irqfds_lock. - acrn_irqfd_deassign() flushes vm->irqfd_wq before returning so the eventfd is fully detached on return. acrn_irqfd_deinit() deactivates every irqfd, flushes the workqueue and only then destroys it, so no path can queue_work() onto a torn-down workqueue. - acrn_irqfd_assign() now installs the eventfd waitqueue entry and publishes the irqfd to vm->irqfds under irqfds_lock, so the irqfd is never visible to deassign/deinit before its waitqueue entry is in place, and any EPOLLHUP that fires in the assign window queues cleanup work that blocks on irqfds_lock until publication is done.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-24T17:17:25.183Z",
  "pubdate": "2026-09-24T17:17:25.183Z",
  "executiveSummary": "This vulnerability is a use-after-free (UAF) condition identified in the ACRN hypervisor's irqfd handling mechanism within the Linux kernel.\nThe flaw originates from a race condition between the irqfd deassignment path and eventfd EPOLLHUP wakeups, allowing for concurrent modification and premature freeing of the 'struct hsm_irqfd' object.\nSuccessful exploitation can lead to a dangling pointer reference within the 'hsm_irqfd_shutdown_work' function when accessing the 'irqfd->vm' structure, potentially resulting in kernel memory corruption, system instability, or a local privilege escalation scenario.\nThe vulnerability affects the ACRN hypervisor subsystem within the Linux kernel where irqfd objects are managed.\nAn attacker capable of triggering concurrent teardown operations on a virtual machine's eventfd-backed irqfd can induce this race condition.\nThe risk is elevated due to the potential for arbitrary kernel code execution or denial-of-service via system crash, necessitating prompt patching of the affected kernel subsystems.",
  "technicalDetails": "The root cause of this use-after-free vulnerability is a synchronization deficiency in the lifecycle management of 'struct hsm_irqfd' objects during shutdown. In the original implementation, the 'acrn_irqfd_deassign()' function and the 'hsm_irqfd_wakeup()' callback (triggered by EPOLLHUP events) operated independently, lacking sufficient mutual exclusion to prevent race conditions during object deallocation.\nWhen an eventfd is released, it triggers 'wake_up_poll(EPOLLHUP)', which invokes 'hsm_irqfd_wakeup()', subsequently queuing 'hsm_irqfd_shutdown_work' via 'queue_work()'. Simultaneously, if a user-space process calls 'acrn_irqfd_deassign()', the kernel executes 'hsm_irqfd_shutdown()', which performs cleanup actions including 'list_del_init()', 'eventfd_ctx_remove_wait_queue()', and 'eventfd_ctx_put()', followed by a final 'kfree(irqfd)'.\nIf 'hsm_irqfd_deassign()' proceeds to free the 'irqfd' object while the asynchronous 'hsm_irqfd_shutdown_work()' is still queued, the worker thread will eventually execute and attempt to access members of the now-freed 'irqfd' (specifically 'irqfd->vm'), leading to a use-after-free condition. This is possible because the 'work' item holds a reference to the structure via 'container_of', which acts as a dangling pointer.\nExploitation requires the attacker to influence the race window between the eventfd release and the explicit irqfd deassignment. By intentionally triggering these teardown paths concurrently, an attacker can ensure that 'kfree' occurs just before the deferred work item executes its memory access.\nThe vulnerability is addressed by adopting the KVM irqfd lifetime model, which utilizes a dedicated 'HSM_IRQFD_FLAG_SHUTDOWN' bit to ensure cleanup is idempotent and executed at most once. Furthermore, the fix mandates that 'hsm_irqfd_shutdown_work()' becomes the sole entity responsible for freeing the memory, ensuring that the eventfd is detached and resources are reclaimed only when it is safe to do so. The introduction of 'vm->irqfd_wq' flushing and strict ordering in 'acrn_irqfd_assign()' ensures that irqfd objects are fully initialized and registered before they can be acted upon by teardown paths, effectively closing the race window."
}