Linux Kernel: VMBus Disconnect State Mismanagement Exploitable
CVE-2026-99216 Published on October 28, 2026
Drivers: hv: Don't reset VMBus connection state on error/exit paths
In the Linux kernel, the following vulnerability has been resolved:
Drivers: hv: Don't reset VMBus connection state on error/exit paths
In two places, current code forces vmbus_connection.conn_state to
DISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect()
calls vmbus_initiate_unload(), which unloads the VMBus connection
only if the conn_state is CONNECTED. Consequently, the connection
remains and the Hyper-V host might continue to send messages or post
VMBus interrupts.
The problem was introduced in commit 74347a99e73ae ("x86/Hyper-V:
Unload vmbus channel in hv panic callback"), in that
vmbus_initiate_unload() started checking the current connection
state before doing the unload. This commit removed some occurrences
where conn_state was forced to DISCONNECTED, but these two remained,
apparently due to an oversight at the time.
Fix this by not forcing conn_state to DISCONNECTED during VMBus exit,
or if a failure occurs when establishing the connection in the first
place. Whatever value conn_state has at the time is then read by
vmbus_initiate_unload() to determine if there is a connection to
be unloaded.
Products Associated with CVE-2026-99216
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 74347a99e73ae00b8385f1209aaea193c670f901 and below f47ce27af80b87cc684d5c12b65506af498ac7e5 is affected.
- Version 74347a99e73ae00b8385f1209aaea193c670f901 and below 3195546a377c2d8d176d837e8baad5ce15d11195 is affected.
- Version 74347a99e73ae00b8385f1209aaea193c670f901 and below ec31dc39e835ccde0930daccece8c492d28282fc is affected.
- Version 5e059fc0f054309036d3f612bc8b0a502ca58545 is affected.
- Version 9f38f7b46de0747c1909e8c557aa21715dce20c5 is affected.
- Version caeeb3787167c884b955404a7e669fd77f267e44 is affected.
- Version 4.19.118 and below 4.20 is affected.
- Version 5.4.35 and below 5.5 is affected.
- Version 5.6.7 and below 5.7 is affected.
- Version 5.7 is affected.
- Before 5.7 is unaffected.
- Version 6.18.59, <= 6.18.* is unaffected.
- Version 7.2.13, <= 7.2.* is unaffected.
- Version 7.3, <= * is unaffected.