CVE-2026-97996: virtio: fix use-after-free in unregister_virtio_device()
In the Linux kernel, the following vulnerability has been resolved:
virtio: fix use-after-free in unregistervirtiodevice()
deviceunregister() is devicedel() plus putdevice(). When the caller holds no extra reference, that drops the last one and runs the release callback, which for several transports frees the memory the embedded struct virtiodevice sits in. unregistervirtiodevice() then calls virtiodebugdeviceexit(), which reads dev->debugfsdir out of the freed object.
Affected transports are the ones whose release callback frees and whose remove path takes no reference: virtiommio, virtiovdpa, virtiouml, mlxbf-tmfifo and virtioccw. virtiopci is unaffected because virtiopciremove() brackets the call with getdevice() and putdevice().
Remove the debugfs entries before the device can go away. They are only accessed through the protected debugfs interface, so debugfsremoverecursive() waits for in-progress file operations before returning. Tearing them down while the device is still alive is therefore safe.
Reproduced on User-Mode Linux with CONFIGKASAN and CONFIGVIRTIODEBUG by unbinding a virtio-uml device:
BUG: KASAN: slab-use-after-free in virtiodebugdeviceexit+0x36/0x4d Read of size 8 at addr 00000000616e0b10 by task init/1 asanreportload8noabort virtiodebugdeviceexit+0x36/0x4d unregistervirtiodevice+0x48/0x75 virtioumlremove platformremove devicereleasedriverinternal unbindstore
Freed by task 1: kfree virtioumlreleasedev devicerelease kobjectput putdevice deviceunregister
With this applied, the report is gone and unbind is clean.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Remove the virtio debugfs entries before the device can go away, ensuring debugfs_remove_recursive() completes before unregister_virtio_device() releases the device.
Event History
Frequently Asked Questions
Which virtio transports are affected?
The affected transports are virtio_mmio, virtio_vdpa, virtio_uml, mlxbf-tmfifo, and virtio_ccw when their release callback frees the containing object and their remove path holds no extra device reference. virtio_pci is not affected because its remove path takes and releases an additional device reference around unregister_virtio_device().
What action triggers the vulnerable path?
The issue occurs during device unregistration, including removal or unbinding of an affected virtio device. It was reproduced by unbinding a virtio-uml device on User-Mode Linux with CONFIG_KASAN and CONFIG_VIRTIO_DEBUG enabled.
What configuration is relevant to reproducing the debugfs access?
The reported reproduction used CONFIG_VIRTIO_DEBUG, because the use-after-free occurs when unregister_virtio_device() accesses the device's debugfs directory after device_unregister() may have freed the device. The debugfs entries are accessed through the protected debugfs interface.
What does the fix change?
The fix removes the virtio debugfs entries before the device can be released. debugfs_remove_recursive() waits for in-progress debugfs file operations, so the entries can be safely removed while the device is still alive.