CVEsLinuxCVE-2026-99216Published Oct 28, 10:36 · Updated Oct 31, 12:45 UTC
8.4
HighCVSS 3.1 · from Linux
CVE-2026-99216

Drivers: hv: Don't reset VMBus connection state on error/exit paths

Linux
AffectedLinux, Linux
FixUpdate to 2939215d57bc8e4189290544fca78f3809ac3ef8, 2e5ffbf1e41abbf6e02ce28115107938f55ff646, 2732210132f92aca0622b5134027990a809279d5, 3195546a377c2d8d176d837e8baad5ce15d11195 or newer
PublishedOct 28, 10:36 · Linux
ScoredOct 28 · 8.4 · Linux
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:07 UTC

What we know

No known exploitation. CISA KEV, checked 22:07 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs local access to the machine. CVSS: local.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.

Description

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on error/exit paths In two places, current code forces vmbus_connection.conn_state to DISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect() calls vmbus_initiate_unload(), which unloads the VMBus connection only if the conn_state is CONNECTED. Consequently, the connection remains and the Hyper-V host might continue to send messages or post VMBus interrupts. The problem was introduced in commit 74347a99e73ae ("x86/Hyper-V: Unload vmbus channel in hv panic callback"), in that vmbus_initiate_unload() started checking the current connection state before doing the unload. This commit removed some occurrences where conn_state was forced to DISCONNECTED, but these two remained, apparently due to an oversight at the time. Fix this by not forcing conn_state to DISCONNECTED during VMBus exit, or if a failure occurs when establishing the connection in the first place. Whatever value conn_state has at the time is then read by vmbus_initiate_unload() to determine if there is a connection to be unloaded.

From Linux

Affected and fixed versions

ProductAffectedFixed inLinux74347a99e73ae00b8385f1209aaea193c670f901 – before 2939215d57bc8e4189290544fca78f3809ac3ef82939215d57bc8e4189290544fca78f3809ac3ef8Linux74347a99e73ae00b8385f1209aaea193c670f901 – before a0ae955ba9a5067a157ebb8defb4a0a9cb1fc304–Linux74347a99e73ae00b8385f1209aaea193c670f901 – before deef3ab5129ae4c45662c957cdab3739eb047fb1–Linux74347a99e73ae00b8385f1209aaea193c670f901 – before 2e5ffbf1e41abbf6e02ce28115107938f55ff6462e5ffbf1e41abbf6e02ce28115107938f55ff646Linux74347a99e73ae00b8385f1209aaea193c670f901 – before 2732210132f92aca0622b5134027990a809279d52732210132f92aca0622b5134027990a809279d5Linux74347a99e73ae00b8385f1209aaea193c670f901 – before f47ce27af80b87cc684d5c12b65506af498ac7e5–Linux74347a99e73ae00b8385f1209aaea193c670f901 – before 3195546a377c2d8d176d837e8baad5ce15d111953195546a377c2d8d176d837e8baad5ce15d11195Linux74347a99e73ae00b8385f1209aaea193c670f901 – before ec31dc39e835ccde0930daccece8c492d28282fc–Linux5e059fc0f054309036d3f612bc8b0a502ca58545–Linux9f38f7b46de0747c1909e8c557aa21715dce20c5–Linuxcaeeb3787167c884b955404a7e669fd77f267e44–Linux4.19.118 – before 4.204.20Linux5.4.35 – before 5.55.5Linux5.6.7 – before 5.75.7Linux5.7–LinuxNot affected0LinuxNot affected5.10.273LinuxNot affected5.15.224LinuxNot affected6.1.191LinuxNot affected6.6.161

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

git.kernel.org/stable/c/2939215d57bc8e4189290544fca78f3809ac3ef8 · git.kernel.orggit.kernel.org/stable/c/a0ae955ba9a5067a157ebb8defb4a0a9cb1fc304 · git.kernel.orggit.kernel.org/stable/c/deef3ab5129ae4c45662c957cdab3739eb047fb1 · git.kernel.orggit.kernel.org/stable/c/2e5ffbf1e41abbf6e02ce28115107938f55ff646 · git.kernel.orggit.kernel.org/stable/c/2732210132f92aca0622b5134027990a809279d5 · git.kernel.orggit.kernel.org/stable/c/f47ce27af80b87cc684d5c12b65506af498ac7e5 · git.kernel.orggit.kernel.org/stable/c/3195546a377c2d8d176d837e8baad5ce15d11195 · git.kernel.orggit.kernel.org/stable/c/ec31dc39e835ccde0930daccece8c492d28282fc · git.kernel.org

Other CVEs in Linux

All 18,185 →
–power: supply: core: prevent unregistering a power supply while a callback runs · CVE-2026-99215Oct 28–drm/vc4: hdmi: Move packet RAM enable to PM runtime · CVE-2026-99214Oct 287.8vsock: treat TCP_CLOSING as once-established · CVE-2026-99213Oct 28