Unscored severity · published Oct 28, 2026
CVE-2026-99216
Drivers: hv: Don't reset VMBus connection state on error/exit paths
New
–
CVSS
–
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved:
Drivers: hv: Don't reset VMBus connection state on error/exit paths
In two places, current code forces vmbus_connection.conn_state to
DISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect()
calls vmbus_initiate_unload(), which unloads the VMBus connection
only if the conn_state is CONNECTED. Consequently, the connection
remains and the Hyper-V host might continue to send messages or post
VMBus interrupts.
The problem was introduced in commit 74347a99e73ae ("x86/Hyper-V:
Unload vmbus channel in hv panic callback"), in that
vmbus_initiate_unload() started checking the current connection
state before doing the unload. This commit removed some occurrences
where conn_state was forced to DISCONNECTED, but these two remained,
apparently due to an oversight at the time.
Fix this by not forcing conn_state to DISCONNECTED during VMBus exit,
or if a failure occurs when establishing the connection in the first
place. Whatever value conn_state has at the time is then read by
vmbus_initiate_unload() to determine if there is a connection to
be unloaded.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Linux · Linux
74347a99e73ae00b8385f1209aaea193c670f901 before f47ce27af80b87cc684d5c12b65506af498ac7e5; 74347a99e73ae00b8385f1209aaea193c670f901 before 3195546a377c2d8d176d837e8baad5ce15d11195; 74347a99e73ae00b8385f1209aaea193c670f901 before ec31dc39e835ccde0930daccece8c492d28282fc; 5e059fc0f054309036d3f612bc8b0a502ca58545; 9f38f7b46de0747c1909e8c557aa21715dce20c5; caeeb3787167c884b955404a7e669fd77f267e44; +4 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-99216
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-99216
git.kernel.org
https://git.kernel.org/stable/c/f47ce27af80b87cc684d5c12b65506af498ac7e5
git.kernel.org
https://git.kernel.org/stable/c/3195546a377c2d8d176d837e8baad5ce15d11195
git.kernel.org
https://git.kernel.org/stable/c/ec31dc39e835ccde0930daccece8c492d28282fc
More from Linux
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
7.8
CVE-2026-53362
ipv6: account for fraggap on the paged allocation path
7.8
CVE-2026-46300
net: skbuff: preserve shared-frag marker during coalescing
7.8
CVE-2026-31431
crypto: algif_aead - Revert to operating out-of-place
