CVE-2026-97986

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97986", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:18:58.208Z", "datePublished": "2026-09-25T10:23:20.801Z", "dateUpdated": "2026-10-19T09:11:53.304Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:11:53.304Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_input: stop callbacks before unregistering input device\n\nvirtinput_remove() unregisters the input device before resetting the\nvirtio device. virtinput_recv_events() drops vi->lock around input_event(),\nso clearing vi->ready does not stop a callback that passed the entry check.\nIt can still use vi->idev, requeue buffers and kick the queue.\n\nReset first, as virtinput_freeze() already does. With the preceding core\nchange, reset waits for callbacks before input_unregister_device() can\nfree vi->idev. Recheck vi->ready after taking the lock again: keep draining\ncompleted events so an input packet is not truncated, but stop requeueing\nbuffers and kicking the queue.\n\nWith evdev attached, input_unregister_handle() currently waits for an RCU\ngrace period, which also waits out IRQ callbacks. This masks the lifetime\nbug on PCI and MMIO, but does not protect sleepable callbacks on other\ntransports."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/virtio/virtio_input.c"], "versions": [{"version": "271c865161c57cfabca45b93eaa712b19da365bc", "lessThan": "3ae729b1f8ab81d1244061872db2fb0ebb110d2a", "status": "affected", "versionType": "git"}, {"version": "271c865161c57cfabca45b93eaa712b19da365bc", "lessThan": "81073bca2062c916c818f2744fbab545a5c4982b", "status": "affected", "versionType": "git"}, {"version": "271c865161c57cfabca45b93eaa712b19da365bc", "lessThan": "8226aeee9b9a94cd699fbb51cb230feff46cfaf2", "status": "affected", "versionType": "git"}, {"version": "271c865161c57cfabca45b93eaa712b19da365bc", "lessThan": "a3ba86a270dd87460759214046dc7cbd409ac711", "status": "affected", "versionType": "git"}, {"version": "271c865161c57cfabca45b93eaa712b19da365bc", "lessThan": "5378f7945856a5ed88e6f9850bc7a68f54090135", "status": "affected", "versionType": "git"}, {"version": "271c865161c57cfabca45b93eaa712b19da365bc", "lessThan": "d7808b37da0a619cf1fa541c2384e783fecc2480", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/virtio/virtio_input.c"], "versions": [{"version": "4.1", "status": "affected"}, {"version": "0", "lessThan": "4.1", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3ae729b1f8ab81d1244061872db2fb0ebb110d2a"}, {"url": "https://git.kernel.org/stable/c/81073bca2062c916c818f2744fbab545a5c4982b"}, {"url": "https://git.kernel.org/stable/c/8226aeee9b9a94cd699fbb51cb230feff46cfaf2"}, {"url": "https://git.kernel.org/stable/c/a3ba86a270dd87460759214046dc7cbd409ac711"}, {"url": "https://git.kernel.org/stable/c/5378f7945856a5ed88e6f9850bc7a68f54090135"}, {"url": "https://git.kernel.org/stable/c/d7808b37da0a619cf1fa541c2384e783fecc2480"}], "title": "virtio_input: stop callbacks before unregistering input device", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/virtio/virtio_input.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3ae729b1f8ab81d1244061872db2fb0ebb110d2a", "status": "affected", "version": "271c865161c57cfabca45b93eaa712b19da365bc", "versionType": "git"}, {"lessThan": "81073bca2062c916c818f2744fbab545a5c4982b", "status": "affected", "version": "271c865161c57cfabca45b93eaa712b19da365bc", "versionType": "git"}, {"lessThan": "8226aeee9b9a94cd699fbb51cb230feff46cfaf2", "status": "affected", "version": "271c865161c57cfabca45b93eaa712b19da365bc", "versionType": "git"}, {"lessThan": "a3ba86a270dd87460759214046dc7cbd409ac711", "status": "affected", "version": "271c865161c57cfabca45b93eaa712b19da365bc", "versionType": "git"}, {"lessThan": "5378f7945856a5ed88e6f9850bc7a68f54090135", "status": "affected", "version": "271c865161c57cfabca45b93eaa712b19da365bc", "versionType": "git"}, {"lessThan": "d7808b37da0a619cf1fa541c2384e783fecc2480", "status": "affected", "version": "271c865161c57cfabca45b93eaa712b19da365bc", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/virtio/virtio_input.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.1"}, {"lessThan": "4.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_input: stop callbacks before unregistering input device\n\nvirtinput_remove() unregisters the input device before resetting the\nvirtio device. virtinput_recv_events() drops vi->lock around input_event(),\nso clearing vi->ready does not stop a callback that passed the entry check.\nIt can still use vi->idev, requeue buffers and kick the queue.\n\nReset first, as virtinput_freeze() already does. With the preceding core\nchange, reset waits for callbacks before input_unregister_device() can\nfree vi->idev. Recheck vi->ready after taking the lock again: keep draining\ncompleted events so an input packet is not truncated, but stop requeueing\nbuffers and kicking the queue.\n\nWith evdev attached, input_unregister_handle() currently waits for an RCU\ngrace period, which also waits out IRQ callbacks. This masks the lifetime\nbug on PCI and MMIO, but does not protect sleepable callbacks on other\ntransports."}], "id": "CVE-2026-97986", "lastModified": "2026-10-19T10:17:49.960", "metrics": {}, "published": "2026-09-25T11:17:26.683", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3ae729b1f8ab81d1244061872db2fb0ebb110d2a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5378f7945856a5ed88e6f9850bc7a68f54090135"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/81073bca2062c916c818f2744fbab545a5c4982b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8226aeee9b9a94cd699fbb51cb230feff46cfaf2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a3ba86a270dd87460759214046dc7cbd409ac711"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d7808b37da0a619cf1fa541c2384e783fecc2480"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: virtio_input: stop callbacks before unregistering input device", "id": "2541120", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541120"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nvirtio_input: stop callbacks before unregistering input device\nvirtinput_remove() unregisters the input device before resetting the\nvirtio device. virtinput_recv_events() drops vi->lock around input_event(),\nso clearing vi->ready does not stop a callback that passed the entry check.\nIt can still use vi->idev, requeue buffers and kick the queue.\nReset first, as virtinput_freeze() already does. With the preceding core\nchange, reset waits for callbacks before input_unregister_device() can\nfree vi->idev. Recheck vi->ready after taking the lock again: keep draining\ncompleted events so an input packet is not truncated, but stop requeueing\nbuffers and kicking the queue.\nWith evdev attached, input_unregister_handle() currently waits for an RCU\ngrace period, which also waits out IRQ callbacks. This masks the lifetime\nbug on PCI and MMIO, but does not protect sleepable callbacks on other\ntransports.", "A flaw was found in the Linux kernel's virtio_input driver. A race condition during device removal can lead to a Denial of Service (DoS) via a kernel crash. Because the driver unregisters the input device before resetting the underlying virtual device, in-flight event callbacks may access freed device data. A local user could exploit this timing issue during device disconnection to destabilize or crash the system."], "name": "CVE-2026-97986", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97986\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97986\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97986.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[271c865161c57cfabca45b93eaa712b19da365bc,8226aeee9b9a94cd699fbb51cb230feff46cfaf2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[271c865161c57cfabca45b93eaa712b19da365bc,a3ba86a270dd87460759214046dc7cbd409ac711)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[271c865161c57cfabca45b93eaa712b19da365bc,5378f7945856a5ed88e6f9850bc7a68f54090135)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[271c865161c57cfabca45b93eaa712b19da365bc,d7808b37da0a619cf1fa541c2384e783fecc2480)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T21:15:14.051838+00:00", "updated": "2026-10-01T06:00:13.933562+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}