CVE-2026-99216
Drivers: hv: Don't reset VMBus connection state on error/exit paths
- Published
- Updated
- Reserved
- Assigned by
- Linux
Description
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on error/exit paths In two places, current code forces vmbus_connection.conn_state to DISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect() calls vmbus_initiate_unload(), which unloads the VMBus connection only if the conn_state is CONNECTED. Consequently, the connection remains and the Hyper-V host might continue to send messages or post VMBus interrupts. The problem was introduced in commit 74347a99e73ae ("x86/Hyper-V: Unload vmbus channel in hv panic callback"), in that vmbus_initiate_unload() started checking the current connection state before doing the unload. This commit removed some occurrences where conn_state was forced to DISCONNECTED, but these two remained, apparently due to an oversight at the time. Fix this by not forcing conn_state to DISCONNECTED during VMBus exit, or if a failure occurs when establishing the connection in the first place. Whatever value conn_state has at the time is then read by vmbus_initiate_unload() to determine if there is a connection to be unloaded.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High8.4 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | High8.4 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.14% · top 97% of all CVEs (6 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.4.
Affected products
- affected 74347a99e73ae00b8385f1209aaea193c670f901 – < 2939215d57bc8e4189290544fca78f3809ac3ef8
- affected 74347a99e73ae00b8385f1209aaea193c670f901 – < a0ae955ba9a5067a157ebb8defb4a0a9cb1fc304
- affected 74347a99e73ae00b8385f1209aaea193c670f901 – < deef3ab5129ae4c45662c957cdab3739eb047fb1
- affected 74347a99e73ae00b8385f1209aaea193c670f901 – < 2e5ffbf1e41abbf6e02ce28115107938f55ff646
- affected 74347a99e73ae00b8385f1209aaea193c670f901 – < 2732210132f92aca0622b5134027990a809279d5
- affected 74347a99e73ae00b8385f1209aaea193c670f901 – < f47ce27af80b87cc684d5c12b65506af498ac7e5
- affected 74347a99e73ae00b8385f1209aaea193c670f901 – < 3195546a377c2d8d176d837e8baad5ce15d11195
- affected 74347a99e73ae00b8385f1209aaea193c670f901 – < ec31dc39e835ccde0930daccece8c492d28282fc
- affected 5e059fc0f054309036d3f612bc8b0a502ca58545
- affected 9f38f7b46de0747c1909e8c557aa21715dce20c5
- affected caeeb3787167c884b955404a7e669fd77f267e44
- affected 4.19.118 – < 4.20
- affected 5.4.35 – < 5.5
- affected 5.6.7 – < 5.7
- affected 5.7
- unaffected < 5.7
- unaffected 5.10.273 – ≤ 5.10.*
- unaffected 5.15.224 – ≤ 5.15.*
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.161 – ≤ 6.6.*
- unaffected 6.12.115 – ≤ 6.12.*
- unaffected 6.18.59 – ≤ 6.18.*
- unaffected 7.2.13 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References (8)
- https://git.kernel.org/stable/c/2939215d57bc8e4189290544fca78f3809ac3ef8 (opens in a new tab)
- https://git.kernel.org/stable/c/a0ae955ba9a5067a157ebb8defb4a0a9cb1fc304 (opens in a new tab)
- https://git.kernel.org/stable/c/deef3ab5129ae4c45662c957cdab3739eb047fb1 (opens in a new tab)
- https://git.kernel.org/stable/c/2e5ffbf1e41abbf6e02ce28115107938f55ff646 (opens in a new tab)
- https://git.kernel.org/stable/c/2732210132f92aca0622b5134027990a809279d5 (opens in a new tab)
- https://git.kernel.org/stable/c/f47ce27af80b87cc684d5c12b65506af498ac7e5 (opens in a new tab)
- https://git.kernel.org/stable/c/3195546a377c2d8d176d837e8baad5ce15d11195 (opens in a new tab)
- https://git.kernel.org/stable/c/ec31dc39e835ccde0930daccece8c492d28282fc (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-99216)Record last updated .