CVE-2026-97478 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, as well as users of the virt: acrn module, should be aware of this vulnerability and take steps to apply the patch or implement additional security measures to prevent exploitation. This includes reviewing and applying the kernel patch, monitoring system logs for potential crashes or errors, and considering additional security measures such as compensating controls and asset inventory management.

Why it matters

This vulnerability has a high CVSS score of 7.8 and can potentially lead to system crashes, code execution, or privilege escalation. Linux kernel developers and users should take steps to apply the patch or implement additional security measures to prevent exploitation.

• Potential system crashes or code execution
• Increased risk of privilege escalation
• Possible data corruption or loss

Technical summary

The vulnerability occurs in the virt: acrn module of the Linux kernel. The acrn_irqfd_deassign() function and the eventfd EPOLLHUP wakeup can race to free the same struct hsm_irqfd, leading to a use-after-free vulnerability. The fix switches to the lifetime model used by KVM irqfds, ensuring that the irqfd is deactivated and the cleanup work is queued at most once. This change prevents the use-after-free vulnerability by ensuring that the irqfd is not accessed after it has been freed. The fix also includes a new HSM_IRQFD_FLAG_SHUTDOWN bit guarded by test_and_set_bit() to ensure the cleanup work is queued at most once.

Defensive priority

High

Recommended defensive actions

• Review and apply the kernel patch to fix the vulnerability
• Monitor system logs for potential crashes or errors related to the virt: acrn module
• Consider implementing additional security measures to prevent exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was resolved in the Linux kernel. The fix switches to the lifetime model used by KVM irqfds, ensuring that the irqfd is deactivated and the cleanup work is queued at most once. This change prevents the use-after-free vulnerability by ensuring that the irqfd is not accessed after it has been freed. The fix also includes a new HSM_IRQFD_FLAG_SHUTDOWN bit guarded by test_and_set_bit() to ensure the cleanup work is queued at most once.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.