CVE-2026-23198: In the Linux kernel, the following vulnerability has been resolved:  KVM: Don't clobber irqfd routing type when deassigning irqfd  When deassigning a KVM_IRQFD, don't clobber the irqfd's copy of the IRQ's routing entry as doing so breaks kvm_arch_irq_bypass_del_producer() on x86 and arm64, which explicitly look for KVM_IRQ_ROUTING_MSI.  Instead, to handle a concurrent routing update, verify that the irqfd is still active before consuming the routing information.  As evidenced by the x86 and arm64 bugs, and another bug in kvm_arch_update_irqfd_routing() (see below), clobbering the entry type without notifying arch code is surprising and error prone.  As a bonus, checking that the irqfd is active provides a convenient location for documenting _why_ KVM must not consume the routing entry for an irqfd that is in the process of being deassigned: once the irqfd is deleted from the list (which happens *before* the eventfd is detached), it will no longer receive updates via kvm_irq_routing_update(), and so KVM could deliver an event using stale routing information (relative to KVM_SET_GSI_ROUTING returning to userspace).  As an even better bonus, explicitly checking for the irqfd being active fixes a similar bug to the one the clobbering is trying to prevent: if an irqfd is deactivated, and then its routing is changed, kvm_irq_routing_update() won't invoke kvm_arch_update_irqfd_routing() (because the irqfd isn't in the list).  And so if the irqfd is in bypass mode, IRQs will continue to be posted using the old routing information.  As for kvm_arch_irq_bypass_del_producer(), clobbering the routing type results in KVM incorrectly keeping the IRQ in bypass mode, which is especially problematic on AMD as KVM tracks IRQs that are being posted to a vCPU in a list whose lifetime is tied to the irqfd.  Without the help of KASAN to detect use-after-free, the most common sympton on AMD is a NULL pointer deref in amd_iommu_update_ga() due to the memory for irqfd structure being re-allocated and zeroed, resulting in irqfd->irq_bypass_data being NULL when read by avic_update_iommu_vcpu_affinity():    BUG: kernel NULL pointer dereference, address: 0000000000000018   #PF: supervisor read access in kernel mode   #PF: error_code(0x0000) - not-present page   PGD 40cf2b9067 P4D 40cf2b9067 PUD 408362a067 PMD 0   Oops: Oops: 0000 [#1] SMP   CPU: 6 UID: 0 PID: 40383 Comm: vfio_irq_test   Tainted: G     U  W  O        6.19.0-smp--5dddc257e6b2-irqfd #31 NONE   Tainted: [U]=USER, [W]=WARN, [O]=OOT_MODULE   Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.78.2-0 09/05/2025   RIP: 0010:amd_iommu_update_ga+0x19/0xe0   Call Trace:    <TASK>    avic_update_iommu_vcpu_affinity+0x3d/0x90 [kvm_amd]    __avic_vcpu_load+0xf4/0x130 [kvm_amd]    kvm_arch_vcpu_load+0x89/0x210 [kvm]    vcpu_load+0x30/0x40 [kvm]    kvm_arch_vcpu_ioctl_run+0x45/0x620 [kvm]    kvm_vcpu_ioctl+0x571/0x6a0 [kvm]    __se_sys_ioctl+0x6d/0xb0    do_syscall_64+0x6f/0x9d0    entry_SYSCALL_64_after_hwframe+0x4b/0x53   RIP: 0033:0x46893b     </TASK>   ---[ end trace 0000000000000000 ]---  If AVIC is inhibited when the irfd is deassigned, the bug will manifest as list corruption, e.g. on the next irqfd assignment.    list_add corruption. next->prev should be prev (ffff8d474d5cd588),                        but was 0000000000000000. (next=ffff8d8658f86530).   ------------[ cut here ]------------   kernel BUG at lib/list_debug.c:31!   Oops: invalid opcode: 0000 [#1] SMP   CPU: 128 UID: 0 PID: 80818 Comm: vfio_irq_test   Tainted: G     U  W  O        6.19.0-smp--f19dc4d680ba-irqfd #28 NONE   Tainted: [U]=USER, [W]=WARN, [O]=OOT_MODULE   Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.78.2-0 09/05/2025   RIP: 0010:__list_add_valid_or_report+0x97/0xc0   Call Trace:    <TASK>    avic_pi_update_irte+0x28e/0x2b0 [kvm_amd]    kvm_pi_update_irte+0xbf/0x190 [kvm]    kvm_arch_irq_bypass_add_producer+0x72/0x90 [kvm]    irq_bypass_register_consumer+0xcd/0x170 [irqbypa ---truncated---