The vulnerability is an irqfd use‑after‑free that occurs during eventfd shutdown. A race between acrn_irqfd_deassign() and an EPOLLHUP wake‑up frees the same hsm_irqfd structure before a queued shutdown work item accesses it via container_of, creating a dangling pointer. This can result in a kernel crash; if an attacker could trigger the race, it may lead to arbitrary code execution, though such exploitation is inferred rather than proven in the public description.

The bug affects any Linux kernel build that includes acrn hypervisor irqfd handling. Any kernel containing the legacy acrn irqfd implementation before the patch introduced at commits 666c7f9e or d8156aac is vulnerable; no specific kernel version is listed.

The CVSS score of 7.8 indicates a high severity vulnerability, but the EPSS score of less than 1% indicates a very low exploitation probability, and it is not listed in the CISA KEV catalog. The likely attack vector is local or hypervisor‑resident code: an attacker with the ability to manage acrn virtual machines could attempt to trigger the race. While the exact exploitation probability is uncertain, the potential for a kernel crash or privilege escalation is inferred, which demands that the vulnerability be addressed promptly.