Linux Kernel CVE-2026-64073

The affected component is irq_work, the kernel mechanism for deferring work to hard-IRQ context. On PREEMPT_RT kernels, non-HARD irq_work does not run in true interrupt context but is instead dispatched to per-CPU kthreads via run_irq_workd(), and irq_work_sync() uses rcuwait() to block until the BUSY bit is cleared. The root cause is a classic use-after-free (CWE-416, though CWE is listed as N/A in the input): the lifetime of the work object is not protected across the window between clearing BUSY and the subsequent dereferences of that object. The upstream fix wraps run_irq_workd() in guard(rcu)() so the whole irq_work_single() execution sits inside an RCU read-side critical section, and adds synchronize_rcu() to irq_work_sync() after rcuwait_wait_event() so the caller waits out an RCU grace period before it may free the work. CPE data (cpe:2.3:a:linux:linux:*) identifies the affected product only generically as the Linux kernel.