The polling timer handler in ACRN prior to 2.5 has a use-after-free for a freed virtio device, related to devicemodel/hw/pci/virtio/*.c.
linux acrn