Race condition in Linux event handler may crash dom0

ISSUE DESCRIPTION

The Linux kernel event channel handling code doesn’t defend the handling of an event against the same event channel being removed in parallel.
This can result in accesses to already freed memory areas or NULL pointer dereferences in the event handling code, leading to misbehaviour of the system or even crashes.

IMPACT

A misbehaving guest can trigger a dom0 crash by sending events for a paravirtualized device while simultaneously reconfiguring it.

VULNERABLE SYSTEMS

All systems with a Linux dom0 are vulnerable.
All Linux kernel versions are vulnerable.