CVE-2026-97996
Received Received - Intake

Use-After-Free in Linux Kernel virtio Subsystem

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: virtio: fix use-after-free in unregister_virtio_device() device_unregister() is device_del() plus put_device(). When the caller holds no extra reference, that drops the last one and runs the release callback, which for several transports frees the memory the embedded struct virtio_device sits in. unregister_virtio_device() then calls virtio_debug_device_exit(), which reads dev->debugfs_dir out of the freed object. Affected transports are the ones whose release callback frees and whose remove path takes no reference: virtio_mmio, virtio_vdpa, virtio_uml, mlxbf-tmfifo and virtio_ccw. virtio_pci is unaffected because virtio_pci_remove() brackets the call with get_device() and put_device(). Remove the debugfs entries before the device can go away. They are only accessed through the protected debugfs interface, so debugfs_remove_recursive() waits for in-progress file operations before returning. Tearing them down while the device is still alive is therefore safe. Reproduced on User-Mode Linux with CONFIG_KASAN and CONFIG_VIRTIO_DEBUG by unbinding a virtio-uml device: BUG: KASAN: slab-use-after-free in virtio_debug_device_exit+0x36/0x4d Read of size 8 at addr 00000000616e0b10 by task init/1 __asan_report_load8_noabort virtio_debug_device_exit+0x36/0x4d unregister_virtio_device+0x48/0x75 virtio_uml_remove platform_remove device_release_driver_internal unbind_store Freed by task 1: kfree virtio_uml_release_dev device_release kobject_put put_device device_unregister With this applied, the report is gone and unbind is clean.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-10-15
AI Q&A
2026-09-25
EPSS Evaluated
2026-10-14
NVD
CVE-2026-97996
EUVD
EUVD-2026-86650

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel virtio *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's virtio subsystem. It occurs when unregister_virtio_device() tries to access a freed virtio_device structure via dev->debugfs_dir in virtio_debug_device_exit(). The issue happens because debugfs entries are not removed before the device memory is freed, leading to a read of freed memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's virtio subsystem and requires kernel debugging features like KASAN to detect. It manifests as a use-after-free in virtio_debug_device_exit during device unbinding. No standard network or system commands can directly detect this; kernel debugging and specific kernel configurations are required.

Impact Analysis

An attacker with local access could exploit this to cause a system crash or execute arbitrary code with kernel privileges. Systems using affected virtio transports (virtio_mmio, virtio_vdpa, virtio_uml, mlxbf-tmfifo, virtio_ccw) are vulnerable. The impact includes potential denial-of-service or privilege escalation.

Compliance Impact

This vulnerability is a use-after-free flaw in the Linux kernel's virtio device handling, which could lead to memory corruption or crashes. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than kernel memory safety issues.

Mitigation Strategies

Apply the kernel patch that removes debugfs entries before device teardown. Update to a kernel version containing the fix. If immediate patching is not possible, avoid unbinding virtio devices (e.g., virtio_mmio, virtio_vdpa, virtio_uml, mlxbf-tmfifo, virtio_ccw) until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97996. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart