UBUNTU-CVE-2026-97996: Use After Free

In the Linux kernel, the following vulnerability has been resolved: virtio: fix use-after-free in unregistervirtiodevice() deviceunregister() is devicedel() plus putdevice(). When the caller holds no extra reference, that drops the last one and runs the release callback, which for several transports frees the memory the embedded struct virtiodevice sits in. unregistervirtiodevice() then calls virtiodebugdeviceexit(), which reads dev->debugfsdir out of the freed object. Affected transports are the ones whose release callback frees and whose remove path takes no reference: virtiommio, virtiovdpa, virtiouml, mlxbf-tmfifo and virtioccw. virtiopci is unaffected because virtiopciremove() brackets the call with getdevice() and putdevice(). Remove the debugfs entries before the device can go away. They are only accessed through the protected debugfs interface, so debugfsremoverecursive() waits for in-progress file operations before returning. Tearing them down while the device is still alive is therefore safe. Reproduced on User-Mode Linux with CONFIGKASAN and CONFIGVIRTIODEBUG by unbinding a virtio-uml device: BUG: KASAN: slab-use-after-free in virtiodebugdeviceexit+0x36/0x4d Read of size 8 at addr 00000000616e0b10 by task init/1 asanreportload8noabort virtiodebugdeviceexit+0x36/0x4d unregistervirtiodevice+0x48/0x75 virtioumlremove platformremove devicereleasedriverinternal unbindstore Freed by task 1: kfree virtioumlreleasedev devicerelease kobjectput putdevice deviceunregister With this applied, the report is gone and unbind is clean.