CVE-2026-97987 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux kernel-based systems. They should verify kernel patch level to prevent potential DMA issues and assess exposure in Linux kernel-based systems to prioritize patching. The vulnerability requires verification of kernel patch level and assessment of exposure in Linux kernel-based systems to prevent potential issues.

Why it matters

A vulnerability in the Linux kernel's virtio_input module requires verification of kernel patch level and assessment of exposure in Linux kernel-based systems to prevent potential issues.

• Verify kernel patch level to prevent potential DMA issues
• Assess exposure in Linux kernel-based systems to prioritize patching

Technical summary

The Linux kernel's virtio_input module has a vulnerability that occurs when input_register_device() fails. The device is marked DRIVER_OK with virtio_device_ready() before calling input_register_device(). If registration fails, the error path clears vi->ready and calls del_vqs() while the device is still live, potentially allowing DMA to queues that have been torn down. The issue is resolved by resetting the device with virtio_reset_device() on the error path.

Defensive priority

Verify kernel version and patch level; assess exposure in Linux kernel-based systems

Recommended defensive actions

• Verify Linux kernel version and patch level
• Assess exposure in Linux kernel-based systems
• Review kernel.org references for patch information
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Kernel.org references are provided for patch information. The vulnerability has been resolved in the Linux kernel. The source detail is limited, and explicit evidence-limit language and defensive verification tasks are required to verify the vulnerability. The affected product deployments need to be verified, and an owner should be assigned for follow-up.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.