{"id":29152,"date":"2026-09-25T20:31:59","date_gmt":"2026-09-25T12:31:59","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-97996"},"modified":"2026-09-25T20:31:59","modified_gmt":"2026-09-25T12:31:59","slug":"cve-2026-97996","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-97996","title":{"rendered":"CVE-2026-97996 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio: fix use-after"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>virtio: fix use-after-free in unregister_virtio_device()<\/p>\n<p>device_unregister() is device_del() plus put_device(). When the caller<br \/>\nholds no extra reference, that drops the last one and runs the release<br \/>\ncallback, which for several transports frees the memory the embedded<br \/>\nstruct virtio_device sits in. unregister_virtio_device() then calls<br \/>\nvirtio_debug_device_exit(), which reads dev-&gt;debugfs_dir out of the freed<br \/>\nobject.<\/p>\n<p>Affected transports are the ones whose release callback frees and whose<br \/>\nremove path takes no reference: virtio_mmio, virtio_vdpa, virtio_uml,<br \/>\nmlxbf-tmfifo and virtio_ccw. virtio_pci is unaffected because<br \/>\nvirtio_pci_remove() brackets the call with get_device() and put_device().<\/p>\n<p>Remove the debugfs entries before the device can go away. They are only<br \/>\naccessed through the protected debugfs interface, so<br \/>\ndebugfs_remove_recursive() waits for in-progress file operations before<br \/>\nreturning. Tearing them down while the device is still alive is therefore<br \/>\nsafe.<\/p>\n<p>Reproduced on User-Mode Linux with CONFIG_KASAN and CONFIG_VIRTIO_DEBUG<br \/>\nby unbinding a virtio-uml device:<\/p>\n<p>  BUG: KASAN: slab-use-after-free in virtio_debug_device_exit+0x36\/0x4d<br \/>\n  Read of size 8 at addr 00000000616e0b10 by task init\/1<br \/>\n   __asan_report_load8_noabort<br \/>\n   virtio_debug_device_exit+0x36\/0x4d<br \/>\n   unregister_virtio_device+0x48\/0x75<br \/>\n   virtio_uml_remove<br \/>\n   platform_remove<br \/>\n   device_release_driver_internal<br \/>\n   unbind_store<\/p>\n<p>  Freed by task 1:<br \/>\n   kfree<br \/>\n   virtio_uml_release_dev<br \/>\n   device_release<br \/>\n   kobject_put<br \/>\n   put_device<br \/>\n   device_unregister<\/p>\n<p>With this applied, the report is gone and unbind is clean.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>virtio: fix use-after-free in unregister_virtio_device()<\/p>\n<p>device_unregister() is device_del() plus put_device(). When the caller<br \/>\nho<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29152","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29152","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29152"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29152"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29152"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}