CVE-2026-97986
Received Received - Intake

Use-After-Free in Linux Kernel Virtio Input Driver

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: virtio_input: stop callbacks before unregistering input device virtinput_remove() unregisters the input device before resetting the virtio device. virtinput_recv_events() drops vi->lock around input_event(), so clearing vi->ready does not stop a callback that passed the entry check. It can still use vi->idev, requeue buffers and kick the queue. Reset first, as virtinput_freeze() already does. With the preceding core change, reset waits for callbacks before input_unregister_device() can free vi->idev. Recheck vi->ready after taking the lock again: keep draining completed events so an input packet is not truncated, but stop requeueing buffers and kicking the queue. With evdev attached, input_unregister_handle() currently waits for an RCU grace period, which also waits out IRQ callbacks. This masks the lifetime bug on PCI and MMIO, but does not protect sleepable callbacks on other transports.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97986
EUVD
EUVD-2026-86640

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the virtio input device handling. The issue occurs when virtinput_remove() unregisters the input device before resetting the virtio device, allowing a callback to still access freed memory or invalid data structures. This happens because virtinput_recv_events() can still execute after vi->ready is cleared but before proper synchronization.

Detection Guidance

This vulnerability is specific to the Linux kernel's virtio input subsystem and does not have direct network detection methods. Detection involves checking kernel versions and verifying if the vulnerable code path exists in the running kernel. Use commands like 'uname -a' to check the kernel version and 'dmesg | grep virtio' to inspect virtio-related logs for anomalies.

Impact Analysis

This vulnerability could lead to system crashes, memory corruption, or privilege escalation if exploited. Attackers might trigger the race condition to cause denial-of-service or execute arbitrary code in the kernel context. Systems using virtio input devices are primarily affected.

Mitigation Strategies

Immediately update the Linux kernel to a patched version that resolves this issue. If updating is not immediately possible, consider disabling virtio input devices if they are not critical to system operations. Monitor vendor advisories for kernel updates and apply them as soon as they are available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97986. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart