CVE-2026-99216

Status: UPDATED  |  Advisory ID: CVE-2026-99216

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

Drivers: hv: Don't reset VMBus connection state on error/exit paths

In two places, current code forces vmbus_connection.conn_state to

DISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect()

calls vmbus_initiate_unload(), which unloads the VMBus connection

only if the conn_state is CONNECTED. Consequently, the connection

remains and the Hyper-V host might continue to send messages or post

VMBus interrupts.

The problem was introduced in commit 74347a99e73ae ("x86/Hyper-V:

Unload vmbus channel in hv panic callback"), in that

vmbus_initiate_unload() started checking the current connection

state before doing the unload. This commit removed some occurrences

where conn_state was forced to DISCONNECTED, but these two remained,

apparently due to an oversight at the time.

Fix this by not forcing conn_state to DISCONNECTED during VMBus exit,

or if a failure occurs when establishing the connection in the first

place. Whatever value conn_state has at the time is then read by

vmbus_initiate_unload() to determine if there is a connection to

be unloaded. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References