CVE-2026-97987: virtio_input: reset device if input_register_device() fails
In the Linux kernel, the following vulnerability has been resolved:
virtioinput: reset device if inputregisterdevice() fails
Probe marks the device DRIVEROK with virtiodeviceready() before calling inputregisterdevice(). If registration fails, the error path cleared vi->ready and called delvqs() while the device was still live, so the device could keep DMA to queues that were already torn down.
Match remove/freeze: call virtioresetdevice() on that path before tearing down the virtqueues.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Operational
On virtio_input registration failure and on remove/freeze paths, call virtio_reset_device() before tearing down the virtqueues.
Event History
Frequently Asked Questions
When is a system exposed to this issue?
The affected path is reached when a virtio input device is being probed and input_register_device() fails. The issue concerns teardown after that registration failure, when virtqueues could be removed while the device remains live.
What is the immediate technical consequence of the faulty error path?
The device may retain DMA access to virtqueues after those queues have been torn down. The resolved code resets the virtio device before deleting the virtqueues, matching the remove and freeze paths.