CVE-2026-97986

A flaw was found in the Linux kernel's virtio_input driver. A race condition during device removal can lead to a Denial of Service (DoS) via a kernel crash. Because the driver unregisters the input device before resetting the underlying virtual device, in-flight event callbacks may access freed device data. A local user could exploit this timing issue during device disconnection to destabilize or crash the system.

A use after free can occur in the virtio input driver because virtinput_remove unregisters and may free vi->idev before virtio device callbacks are stopped. A callback that passed the vi->ready check can drop the lock around input_event and later resume using vi->idev while also requeueing buffers and kicking the virtqueue. This can cause kernel memory corruption, at least a guest kernel crash, and potentially confidentiality integrity or privilege impact if the stale object is reused in a controllable way. For the CVSS the PR:L in the paranoid score reflects environments where a reduced capability service account, container root, or virtual machine management user can influence virtio device reset or removal without full host administration. The issue is not directly network reachable. Exploitation depends on local or virtualization control of the virtio device lifecycle and on callback timing.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.