Linux Kernel CVE-2026-97478

Requires the ACRN hypervisor to be built and running on the host with the acrn HSM (Hypervisor Service Module) kernel driver loaded and an ACRN virtual machine present - this is not a default Linux configuration and is confined to ACRN embedded/IoT/automotive deployments. The attacker needs local access sufficient to assign/deassign irqfds for an ACRN VM (control of the HSM ioctl path) and must supply/close a backing eventfd. Exploitation further depends on winning a narrow timing window: the acrn_irqfd_deassign()/deinit path and an eventfd EPOLLHUP wakeup must fire concurrently against the same hsm_irqfd. Limiting factors: non-default ACRN stack, required privileged access to the HSM device, and race-condition timing that makes reliable triggering difficult.

The input CVSS is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), which frames this as a high-severity local privilege-escalation-class flaw with full C/I/A impact. That framing overstates realistic risk on two axes. First, this is a use-after-free driven by a genuine data race between acrn_irqfd_deassign()/deinit and an eventfd EPOLLHUP wakeup - races are inherently timing-dependent and should carry AC:H, not AC:L. Second, the fix and code path show a dangling struct hsm_irqfd being resurrected via container_of() and dereferenced, which is a memory-corruption/DoS primitive; the realistic dominant outcome is a kernel panic (A:H), while the claimed C:H/I:H (information disclosure / integrity) is speculative for a freed-object dereference and not demonstrated. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so exploitation is unproven. Critically, reaching this code at all requires the ACRN hypervisor stack to be built and running with the HSM (Hypervisor Service Module) device driver active and a caller privileged enough to assign/deassign irqfds for an ACRN VM - a very narrow deployment. Net: this is a legitimate kernel memory-safety bug worth patching on ACRN hosts, but it is far from a broad-fleet priority and the tag/label and NVD-style score overstate it. Note the CVSS vector says AV:L (local) which is consistent with the description (ioctl/eventfd path), but the 'Information Disclosure' tag conflicts with the actual UAF/DoS nature - treat impact claims with caution.

On a host running the ACRN hypervisor with the acrn HSM driver, a local user with access to manage an ACRN VM's irqfds concurrently closes the backing eventfd (triggering EPOLLHUP) while issuing an irqfd deassign, racing the two cleanup paths so the same hsm_irqfd is freed twice / dereferenced after free. Winning the race lets the queued shutdown work item dereference a dangling pointer through container_of(), corrupting kernel memory and most plausibly panicking the host. No public exploit code is identified at time of analysis, and success depends on timing.