{"id":"CVE-2026-97986","summary":"virtio_input: stop callbacks before unregistering input device","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_input: stop callbacks before unregistering input device\n\nvirtinput_remove() unregisters the input device before resetting the\nvirtio device. virtinput_recv_events() drops vi-\u003elock around input_event(),\nso clearing vi-\u003eready does not stop a callback that passed the entry check.\nIt can still use vi-\u003eidev, requeue buffers and kick the queue.\n\nReset first, as virtinput_freeze() already does. With the preceding core\nchange, reset waits for callbacks before input_unregister_device() can\nfree vi-\u003eidev. Recheck vi-\u003eready after taking the lock again: keep draining\ncompleted events so an input packet is not truncated, but stop requeueing\nbuffers and kicking the queue.\n\nWith evdev attached, input_unregister_handle() currently waits for an RCU\ngrace period, which also waits out IRQ callbacks. This masks the lifetime\nbug on PCI and MMIO, but does not protect sleepable callbacks on other\ntransports.","modified":"2026-09-27T03:47:35.077554960Z","published":"2026-09-25T10:23:20.801Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97986.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/5378f7945856a5ed88e6f9850bc7a68f54090135"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8226aeee9b9a94cd699fbb51cb230feff46cfaf2"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a3ba86a270dd87460759214046dc7cbd409ac711"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d7808b37da0a619cf1fa541c2384e783fecc2480"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97986.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97986"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"271c865161c57cfabca45b93eaa712b19da365bc"},{"fixed":"8226aeee9b9a94cd699fbb51cb230feff46cfaf2"},{"fixed":"a3ba86a270dd87460759214046dc7cbd409ac711"},{"fixed":"5378f7945856a5ed88e6f9850bc7a68f54090135"},{"fixed":"d7808b37da0a619cf1fa541c2384e783fecc2480"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97986.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"6.12.111"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.53"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.7"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97986.json"}}],"schema_version":"1.9.0"}