Virtio_input, a driver for virtio devices that provide input devices, marks a device as ready before it has successfully registered it with the input subsystem. If the registration fails, the driver clears the ready flag but still tears down virtqueues while the device is live, allowing the device to continue performing DMA on queues that have already been dismantled. This can corrupt kernel memory or crash the system, resulting in a denial‑of‑service condition.

All installations of the Linux kernel that include the virtio_input driver are potentially vulnerable. The flaw is present in any kernel version that has not yet applied the patch that inserts virtio_reset_device on the error path before tearing down the virtqueues. All kernel releases that ship the unmodified virtio_input code are therefore affected.

The CVSS score of 5.5 indicates moderate severity. The EPSS score is lower than 1% and the flaw is not listed in CISA’s KEV catalog, indicating a low probability of exploitation. The vulnerability could be leveraged by causing the input_register_device call to fail during probe—e.g., by feeding malformed data from a guest—to trigger the faulty cleanup path. Based on the description, the likely attack vector is local or requires elevated privileges on the host to initiate the probe or directly interact with the device. No confirmed attacks have been reported.