All vulnerabilities
CVE-2026-99216

Linux: Drivers: hv: Don't reset VMBus connection state on error/exit paths

Linux LinuxOperating systems
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in3195546a377c2d8d176d837e8baad5ce15d11195Also 4.20, 5.5 and 1 moreCVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

Drivers: hv: Don't reset VMBus connection state on error/exit paths

In two places, current code forces vmbus_connection.conn_state to DISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect() calls vmbus_initiate_unload(), which unloads the VMBus connection only if the conn_state is CONNECTED. Consequently, the connection remains and the Hyper-V host might continue to send messages or post VMBus interrupts.

The problem was introduced in commit 74347a99e73ae ("x86/Hyper-V: Unload vmbus channel in hv panic callback"), in that vmbus_initiate_unload() started checking the current connection state before doing the unload. This commit removed some occurrences where conn_state was forced to DISCONNECTED, but these two remained, apparently due to an oversight at the time.

Fix this by not forcing conn_state to DISCONNECTED during VMBus exit, or if a failure occurs when establishing the connection in the first place. Whatever value conn_state has at the time is then read by vmbus_initiate_unload() to determine if there is a connection to be unloaded.

Text from CVE List

Affected versions 14

  • Linuxaffected: 74347a99e73ae00b8385f1209aaea193c670f901 before f47ce27af80b87cc684d5c12b65506af498ac7e5CVE List
  • Linuxaffected: 74347a99e73ae00b8385f1209aaea193c670f901 before 3195546a377c2d8d176d837e8baad5ce15d11195CVE List
  • Linuxaffected: 74347a99e73ae00b8385f1209aaea193c670f901 before ec31dc39e835ccde0930daccece8c492d28282fcCVE List
  • Linuxaffected: 5e059fc0f054309036d3f612bc8b0a502ca58545CVE List
  • Linuxaffected: 9f38f7b46de0747c1909e8c557aa21715dce20c5CVE List
  • Linuxaffected: caeeb3787167c884b955404a7e669fd77f267e44CVE List
  • Linuxaffected: 4.19.118 before 4.20CVE List
  • Linuxaffected: 5.4.35 before 5.5CVE List
  • Linuxaffected: 5.6.7 before 5.7CVE List
  • Linuxaffected: 5.7CVE List
  • Linuxunaffected: all versions before 5.7CVE List
  • Linuxunaffected: 6.18.59 through 6.18.*CVE List
  • Linuxunaffected: 7.2.13 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3