CVE-2026-97996

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

virtio: fix use-after-free in unregister_virtio_device()

device_unregister() is device_del() plus put_device(). When the caller

holds no extra reference, that drops the last one and runs the release

callback, which for several transports frees the memory the embedded

struct virtio_device sits in. unregister_virtio_device() then calls

virtio_debug_device_exit(), which reads dev->debugfs_dir out of the freed

object.

Affected transports are the ones whose release callback frees and whose

remove path takes no reference: virtio_mmio, virtio_vdpa, virtio_uml,

mlxbf-tmfifo and virtio_ccw. virtio_pci is unaffected because

virtio_pci_remove() brackets the call with get_device() and put_device().

Remove the debugfs entries before the device can go away. They are only

accessed through the protected debugfs interface, so

debugfs_remove_recursive() waits for in-progress file operations before

returning. Tearing them down while

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References