CVE-2026-97996
Received Received - Intake

Use-After-Free in Linux Kernel virtio Subsystem

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: virtio: fix use-after-free in unregister_virtio_device() device_unregister() is device_del() plus put_device(). When the caller holds no extra reference, that drops the last one and runs the release callback, which for several transports frees the memory the embedded struct virtio_device sits in. unregister_virtio_device() then calls virtio_debug_device_exit(), which reads dev->debugfs_dir out of the freed object. Affected transports are the ones whose release callback frees and whose remove path takes no reference: virtio_mmio, virtio_vdpa, virtio_uml, mlxbf-tmfifo and virtio_ccw. virtio_pci is unaffected because virtio_pci_remove() brackets the call with get_device() and put_device(). Remove the debugfs entries before the device can go away. They are only accessed through the protected debugfs interface, so debugfs_remove_recursive() waits for in-progress file operations before returning. Tearing them down while the device is still alive is therefore safe. Reproduced on User-Mode Linux with CONFIG_KASAN and CONFIG_VIRTIO_DEBUG by unbinding a virtio-uml device: BUG: KASAN: slab-use-after-free in virtio_debug_device_exit+0x36/0x4d Read of size 8 at addr 00000000616e0b10 by task init/1 __asan_report_load8_noabort virtio_debug_device_exit+0x36/0x4d unregister_virtio_device+0x48/0x75 virtio_uml_remove platform_remove device_release_driver_internal unbind_store Freed by task 1: kfree virtio_uml_release_dev device_release kobject_put put_device device_unregister With this applied, the report is gone and unbind is clean.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97996
EUVD
EUVD-2026-86650

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel virtio *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's virtio subsystem. It occurs when unregister_virtio_device() tries to access a freed virtio_device structure via dev->debugfs_dir in virtio_debug_device_exit(). The issue happens because debugfs entries are not removed before the device memory is freed, leading to a read of freed memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's virtio subsystem and requires kernel debugging features like KASAN to detect. It manifests as a use-after-free in virtio_debug_device_exit during device unbinding. No standard network or system commands can directly detect this; kernel debugging and specific kernel configurations are required.

Impact Analysis

An attacker with local access could exploit this to cause a system crash or execute arbitrary code with kernel privileges. Systems using affected virtio transports (virtio_mmio, virtio_vdpa, virtio_uml, mlxbf-tmfifo, virtio_ccw) are vulnerable. The impact includes potential denial-of-service or privilege escalation.

Mitigation Strategies

Apply the kernel patch that removes debugfs entries before device teardown. Update to a kernel version containing the fix. If immediate patching is not possible, avoid unbinding virtio devices (e.g., virtio_mmio, virtio_vdpa, virtio_uml, mlxbf-tmfifo, virtio_ccw) until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97996. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart