CVE-2026-97987: virtio_input: reset device if input_register_device() fails
In the Linux kernel, the following vulnerability has been resolved:
virtioinput: reset device if inputregisterdevice() fails
Probe marks the device DRIVEROK with virtiodeviceready() before calling inputregisterdevice(). If registration fails, the error path cleared vi->ready and called delvqs() while the device was still live, so the device could keep DMA to queues that were already torn down.
Match remove/freeze: call virtioresetdevice() on that path before tearing down the virtqueues.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the virtio_input registration-failure path, call virtio_reset_device() before tearing down the virtqueues with del_vqs(), so the device cannot continue DMA to queues that have already been removed.
Event History
Frequently Asked Questions
When is a system exposed to this issue?
The affected path is reached when a virtio input device is being probed and input_register_device() fails. The issue concerns teardown after that registration failure, when virtqueues could be removed while the device remains live.
What is the immediate technical consequence of the faulty error path?
The device may retain DMA access to virtqueues after those queues have been torn down. The resolved code resets the virtio device before deleting the virtqueues, matching the remove and freeze paths.