SB20260928219 - Use-after-free in Linux kernel virtio driver

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-97986)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a use-after-free.

The vulnerability exists due to a race condition in virtinput_remove() and virtinput_recv_events() when a virtio input callback runs during input-device unregistration. A local user can cause a callback that passed the ready-state check to access vi->idev after it is freed to trigger a use-after-free.

The lifetime issue is not protected for sleepable callbacks on transports other than PCI and MMIO.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/5378f7945856a5ed88e6f9850bc7a68f54090135
• https://git.kernel.org/stable/c/8226aeee9b9a94cd699fbb51cb230feff46cfaf2
• https://git.kernel.org/stable/c/a3ba86a270dd87460759214046dc7cbd409ac711
• https://git.kernel.org/stable/c/d7808b37da0a619cf1fa541c2384e783fecc2480