{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.111-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  virtio: fix use-after-free in unregister_virtio_device()  device_unregister() is device_del() plus put_device(). When the caller holds no extra reference, that drops the last one and runs the release callback, which for several transports frees the memory the embedded struct virtio_device sits in. unregister_virtio_device() then calls virtio_debug_device_exit(), which reads dev-\u003edebugfs_dir out of the freed object.  Affected transports are the ones whose release callback frees and whose remove path takes no reference: virtio_mmio, virtio_vdpa, virtio_uml, mlxbf-tmfifo and virtio_ccw. virtio_pci is unaffected because virtio_pci_remove() brackets the call with get_device() and put_device().  Remove the debugfs entries before the device can go away. They are only accessed through the protected debugfs interface, so debugfs_remove_recursive() waits for in-progress file operations before returning. Tearing them down while the device is still alive is therefore safe.  Reproduced on User-Mode Linux with CONFIG_KASAN and CONFIG_VIRTIO_DEBUG by unbinding a virtio-uml device:    BUG: KASAN: slab-use-after-free in virtio_debug_device_exit+0x36/0x4d   Read of size 8 at addr 00000000616e0b10 by task init/1    __asan_report_load8_noabort    virtio_debug_device_exit+0x36/0x4d    unregister_virtio_device+0x48/0x75    virtio_uml_remove    platform_remove    device_release_driver_internal    unbind_store    Freed by task 1:    kfree    virtio_uml_release_dev    device_release    kobject_put    put_device    device_unregister  With this applied, the report is gone and unbind is clean.",
  "id": "DEBIAN-CVE-2026-97996",
  "modified": "2026-09-29T10:47:29.667116796Z",
  "published": "2026-09-25T11:17:27.880Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-97996"
    }
  ],
  "upstream": [
    "CVE-2026-97996"
  ]
}