# virt: acrn: Fix irqfd use-after-free during eventfd shutdown CVE record · `CVE-2026-97478` - **Identifiers:** `CVE-2026-97478` - **State:** Confirmed - **Severity:** CVSS 7.8 High - **Critical:** No - **CNA:** Linux - **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md) - **Published:** 24 Sept 2026 - **Updated:** 30 Oct 2026 - **Reviewed by a person:** No Published by the CVE Program (CNA: Linux) at 24 Sept 2026, 16:04 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. ## Affected products, as the CNA wrote them - Vendor: Linux. Product: Linux. - affected: `aa3b483ff1d71c50b33db154048dff9a8f08ac71 to before dccf23a72a6c5ec8d9eab2a7f98e186af6eaff48` (git) - affected: `aa3b483ff1d71c50b33db154048dff9a8f08ac71 to before 6e9e007ee1dfb54bc2d070550308077ec28dbaec` (git) - affected: `aa3b483ff1d71c50b33db154048dff9a8f08ac71 to before 0e1152f689847b9db2f05454775d34610c1424c2` (git) - affected: `aa3b483ff1d71c50b33db154048dff9a8f08ac71 to before d8156aacfcabb81f52c20ef89094945434d08079` (git) - affected: `aa3b483ff1d71c50b33db154048dff9a8f08ac71 to before 666c7f9e07925aa0863348f960e09bb89f8f05a3` (git) - Other versions: unaffected - Vendor: Linux. Product: Linux. - affected: `5.12` - unaffected: `before 5.12` (semver) - unaffected: `6.1.191 to 6.1.*, inclusive` (semver) - unaffected: `6.6.160 to 6.6.*, inclusive` (semver) - unaffected: `6.12.114 to 6.12.*, inclusive` (semver) - unaffected: `6.18.53 to 6.18.*, inclusive` (semver) - unaffected: `7.2 to *, inclusive` (original_commit_for_fix) - Other versions: affected ## Machine-written summary Summary written by Claude Haiku from the source advisory. Not reviewed by a person. > This is a Linux kernel use-after-free in the ACRN hypervisor's irqfd handling (virt: acrn), where an eventfd hang-up and irqfd deassignment can race to free the same structure, leaving a shutdown work item to dereference freed memory. The description does not state what an attacker needs to trigger it or what they could achieve beyond the memory corruption. Affected kernels are 5.12 and later up to the fixes listed in the source, with 6.1, 6.6, 6.12 and 6.18 stable branches fixed at the versions given. Upgrade to a fixed kernel version for your stable branch; no workaround is listed. Written 12 Nov 2026. ## Not analysed yet We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter. ## Severity and exploitation - 7.8 High, CVSS 3.1: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, from CNA (Linux) - **CISA KEV:** Not listed. - **EPSS:** 0.0013, the 2nd percentile, on 12 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days. ## Timeline This record came from the full history of the CVE Program, published 24 Sept 2026. New records show when each source confirmed them. ## Sources - [CVE List: CVE-2026-97478](https://www.cve.org/CVERecord?id=CVE-2026-97478) - [NVD: CVE-2026-97478](https://nvd.nist.gov/vuln/detail/CVE-2026-97478) ### References from the CNA - - - - - Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description. ## Check whether this affects you This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run. - With the agentprime MCP server (), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: - As JSON: - Everything that needs attention now: --- The web page: . Everything for agents: .