---
id: CVE-2026-97996
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  virtio: fix use-after-free in unregister_virtio_device()

  device_unregister() is device_del() plus put_device()
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  virtio: fix use-after-free in unregister_virtio_device()

  device_unregister() is device_del() plus put_device(). When the caller
  holds no extra reference, that drops th…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 96a8326d69fffd7e8c2eb737dc060d8009a33b39 <
    951cad50cba89e736afdee4a730e0e52f9245c9b
  - >-
    Linux >= 96a8326d69fffd7e8c2eb737dc060d8009a33b39 <
    77dbd10a701a30fdfea5c3bb7a29163128f9a9c7
  - >-
    Linux >= 96a8326d69fffd7e8c2eb737dc060d8009a33b39 <
    caf042153016d651b55d0fb4a63cdf7d0d23dee2
  - >-
    Linux >= 96a8326d69fffd7e8c2eb737dc060d8009a33b39 <
    3f9a0fceb730f5107d52421ead5568eae25a0049
  - Linux 6.10
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T11:17:27.880'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97996'
references:
  - url: 'https://git.kernel.org/stable/c/3f9a0fceb730f5107d52421ead5568eae25a0049'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/77dbd10a701a30fdfea5c3bb7a29163128f9a9c7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/951cad50cba89e736afdee4a730e0e52f9245c9b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/caf042153016d651b55d0fb4a63cdf7d0d23dee2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T11:06:38.863Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

virtio: fix use-after-free in unregister_virtio_device()

device_unregister() is device_del() plus put_device(). When the caller
holds no extra reference, that drops the last one and runs the release
callback, which for several transports frees the memory the embedded
struct virtio_device sits in. unregister_virtio_device() then calls
virtio_debug_device_exit(), which reads dev->debugfs_dir out of the freed
object.

Affected transports are the ones whose release callback frees and whose
remove path takes no reference: virtio_mmio, virtio_vdpa, virtio_uml,
mlxbf-tmfifo and virtio_ccw. virtio_pci is unaffected because
virtio_pci_remove() brackets the call with get_device() and put_device().

Remove the debugfs entries before the device can go away. They are only
accessed through the protected debugfs interface, so
debugfs_remove_recursive() waits for in-progress file operations before
returning. Tearing them down while the device is still alive is therefore
safe.

Reproduced on User-Mode Linux with CONFIG_KASAN and CONFIG_VIRTIO_DEBUG
by unbinding a virtio-uml device:

  BUG: KASAN: slab-use-after-free in virtio_debug_device_exit+0x36/0x4d
  Read of size 8 at addr 00000000616e0b10 by task init/1
   __asan_report_load8_noabort
   virtio_debug_device_exit+0x36/0x4d
   unregister_virtio_device+0x48/0x75
   virtio_uml_remove
   platform_remove
   device_release_driver_internal
   unbind_store

  Freed by task 1:
   kfree
   virtio_uml_release_dev
   device_release
   kobject_put
   put_device
   device_unregister

With this applied, the report is gone and unbind is clean.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.