---
id: CVE-2026-97986
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  virtio_input: stop callbacks before unregistering input device

  virtinput_remove() unregisters the input device before resetting the
  virtio device
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  virtio_input: stop callbacks before unregistering input device

  virtinput_remove() unregisters the input device before resetting the
  virtio device. virtinput_recv_event…
severity: medium
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 271c865161c57cfabca45b93eaa712b19da365bc <
    3ae729b1f8ab81d1244061872db2fb0ebb110d2a
  - >-
    Linux >= 271c865161c57cfabca45b93eaa712b19da365bc <
    81073bca2062c916c818f2744fbab545a5c4982b
  - >-
    Linux >= 271c865161c57cfabca45b93eaa712b19da365bc <
    8226aeee9b9a94cd699fbb51cb230feff46cfaf2
  - >-
    Linux >= 271c865161c57cfabca45b93eaa712b19da365bc <
    a3ba86a270dd87460759214046dc7cbd409ac711
  - >-
    Linux >= 271c865161c57cfabca45b93eaa712b19da365bc <
    5378f7945856a5ed88e6f9850bc7a68f54090135
  - >-
    Linux >= 271c865161c57cfabca45b93eaa712b19da365bc <
    d7808b37da0a619cf1fa541c2384e783fecc2480
  - Linux 4.1
published: '2026-09-25'
updated: '2026-10-03'
sourceUpdated: '2026-10-03T11:18:22.500'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97986'
references:
  - url: 'https://git.kernel.org/stable/c/3ae729b1f8ab81d1244061872db2fb0ebb110d2a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5378f7945856a5ed88e6f9850bc7a68f54090135'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/81073bca2062c916c818f2744fbab545a5c4982b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8226aeee9b9a94cd699fbb51cb230feff46cfaf2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a3ba86a270dd87460759214046dc7cbd409ac711'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d7808b37da0a619cf1fa541c2384e783fecc2480'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97986.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-97986'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2541120'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-97986'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97986'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97986.mbox
  - url: 'https://kernelcve.org/list/?q=CVE-2026-97986'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00173
epssPercentile: 0.06641
ingestedAt: '2026-09-25T11:06:38.866Z'
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-416
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

virtio_input: stop callbacks before unregistering input device

virtinput_remove() unregisters the input device before resetting the
virtio device. virtinput_recv_events() drops vi->lock around input_event(),
so clearing vi->ready does not stop a callback that passed the entry check.
It can still use vi->idev, requeue buffers and kick the queue.

Reset first, as virtinput_freeze() already does. With the preceding core
change, reset waits for callbacks before input_unregister_device() can
free vi->idev. Recheck vi->ready after taking the lock again: keep draining
completed events so an input packet is not truncated, but stop requeueing
buffers and kicking the queue.

With evdev attached, input_unregister_handle() currently waits for an RCU
grace period, which also waits out IRQ callbacks. This masks the lifetime
bug on PCI and MMIO, but does not protect sleepable callbacks on other
transports.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97986.json)