CVE-2026-97987

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97987", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:18:58.209Z", "datePublished": "2026-09-25T10:23:21.388Z", "dateUpdated": "2026-10-19T09:11:54.271Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:11:54.271Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_input: reset device if input_register_device() fails\n\nProbe marks the device DRIVER_OK with virtio_device_ready() before\ncalling input_register_device(). If registration fails, the error path\ncleared vi->ready and called del_vqs() while the device was still live,\nso the device could keep DMA to queues that were already torn down.\n\nMatch remove/freeze: call virtio_reset_device() on that path before\ntearing down the virtqueues."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/virtio/virtio_input.c"], "versions": [{"version": "271c865161c57cfabca45b93eaa712b19da365bc", "lessThan": "087b9ee4d36968329c846e6846e4e50f66532888", "status": "affected", "versionType": "git"}, {"version": "271c865161c57cfabca45b93eaa712b19da365bc", "lessThan": "16c90260ae7ae32d7ac9128fb5da404c37154765", "status": "affected", "versionType": "git"}, {"version": "271c865161c57cfabca45b93eaa712b19da365bc", "lessThan": "9a7e107734137f098f9b81e5615aa5a02c5395c7", "status": "affected", "versionType": "git"}, {"version": "271c865161c57cfabca45b93eaa712b19da365bc", "lessThan": "8407da8974326c1ffdfe6a5a9bfc8fed3212bbdf", "status": "affected", "versionType": "git"}, {"version": "271c865161c57cfabca45b93eaa712b19da365bc", "lessThan": "668ebfea7ba623450b12fdeaa0d080464d0c0a14", "status": "affected", "versionType": "git"}, {"version": "271c865161c57cfabca45b93eaa712b19da365bc", "lessThan": "81489b32a21c9360f8750d1fb600155d27452e19", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/virtio/virtio_input.c"], "versions": [{"version": "4.1", "status": "affected"}, {"version": "0", "lessThan": "4.1", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/087b9ee4d36968329c846e6846e4e50f66532888"}, {"url": "https://git.kernel.org/stable/c/16c90260ae7ae32d7ac9128fb5da404c37154765"}, {"url": "https://git.kernel.org/stable/c/9a7e107734137f098f9b81e5615aa5a02c5395c7"}, {"url": "https://git.kernel.org/stable/c/8407da8974326c1ffdfe6a5a9bfc8fed3212bbdf"}, {"url": "https://git.kernel.org/stable/c/668ebfea7ba623450b12fdeaa0d080464d0c0a14"}, {"url": "https://git.kernel.org/stable/c/81489b32a21c9360f8750d1fb600155d27452e19"}], "title": "virtio_input: reset device if input_register_device() fails", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/virtio/virtio_input.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "087b9ee4d36968329c846e6846e4e50f66532888", "status": "affected", "version": "271c865161c57cfabca45b93eaa712b19da365bc", "versionType": "git"}, {"lessThan": "16c90260ae7ae32d7ac9128fb5da404c37154765", "status": "affected", "version": "271c865161c57cfabca45b93eaa712b19da365bc", "versionType": "git"}, {"lessThan": "9a7e107734137f098f9b81e5615aa5a02c5395c7", "status": "affected", "version": "271c865161c57cfabca45b93eaa712b19da365bc", "versionType": "git"}, {"lessThan": "8407da8974326c1ffdfe6a5a9bfc8fed3212bbdf", "status": "affected", "version": "271c865161c57cfabca45b93eaa712b19da365bc", "versionType": "git"}, {"lessThan": "668ebfea7ba623450b12fdeaa0d080464d0c0a14", "status": "affected", "version": "271c865161c57cfabca45b93eaa712b19da365bc", "versionType": "git"}, {"lessThan": "81489b32a21c9360f8750d1fb600155d27452e19", "status": "affected", "version": "271c865161c57cfabca45b93eaa712b19da365bc", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/virtio/virtio_input.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.1"}, {"lessThan": "4.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_input: reset device if input_register_device() fails\n\nProbe marks the device DRIVER_OK with virtio_device_ready() before\ncalling input_register_device(). If registration fails, the error path\ncleared vi->ready and called del_vqs() while the device was still live,\nso the device could keep DMA to queues that were already torn down.\n\nMatch remove/freeze: call virtio_reset_device() on that path before\ntearing down the virtqueues."}], "id": "CVE-2026-97987", "lastModified": "2026-10-19T10:17:50.063", "metrics": {}, "published": "2026-09-25T11:17:26.797", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/087b9ee4d36968329c846e6846e4e50f66532888"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/16c90260ae7ae32d7ac9128fb5da404c37154765"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/668ebfea7ba623450b12fdeaa0d080464d0c0a14"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/81489b32a21c9360f8750d1fb600155d27452e19"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8407da8974326c1ffdfe6a5a9bfc8fed3212bbdf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9a7e107734137f098f9b81e5615aa5a02c5395c7"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: virtio_input: reset device if input_register_device() fails", "id": "2541157", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541157"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nvirtio_input: reset device if input_register_device() fails\nProbe marks the device DRIVER_OK with virtio_device_ready() before\ncalling input_register_device(). If registration fails, the error path\ncleared vi->ready and called del_vqs() while the device was still live,\nso the device could keep DMA to queues that were already torn down.\nMatch remove/freeze: call virtio_reset_device() on that path before\ntearing down the virtqueues.", "A flaw was found in the Linux kernel's virtio_input driver. When device registration fails during initialization, the driver removes communication queues without first resetting the device. This allows the virtual device to continue Direct Memory Access (DMA) operations on memory that has already been deallocated, which may result in memory corruption or a Denial of Service (DoS)."], "name": "CVE-2026-97987", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97987\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97987\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97987.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[271c865161c57cfabca45b93eaa712b19da365bc,9a7e107734137f098f9b81e5615aa5a02c5395c7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[271c865161c57cfabca45b93eaa712b19da365bc,8407da8974326c1ffdfe6a5a9bfc8fed3212bbdf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[271c865161c57cfabca45b93eaa712b19da365bc,668ebfea7ba623450b12fdeaa0d080464d0c0a14)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[271c865161c57cfabca45b93eaa712b19da365bc,81489b32a21c9360f8750d1fb600155d27452e19)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T19:30:20.153937+00:00", "updated": "2026-10-01T06:30:01.899846+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}