{"id":"CVE-2026-99216","title":"Drivers: hv: Don't reset VMBus connection state on error/exit paths","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: Don't reset VMBus connection state on error/exit paths\n\nIn two places, current code forces vmbus_connection.conn_state to\nDISCONNECTED prior to calling vmb…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 74347a99e73ae00b8385f1209aaea193c670f901 < f47ce27af80b87cc684d5c12b65506af498ac7e5","Linux >= 74347a99e73ae00b8385f1209aaea193c670f901 < 3195546a377c2d8d176d837e8baad5ce15d11195","Linux >= 74347a99e73ae00b8385f1209aaea193c670f901 < ec31dc39e835ccde0930daccece8c492d28282fc","Linux 5e059fc0f054309036d3f612bc8b0a502ca58545","Linux 9f38f7b46de0747c1909e8c557aa21715dce20c5","Linux caeeb3787167c884b955404a7e669fd77f267e44","Linux >= 4.19.118 < 4.20","Linux >= 5.4.35 < 5.5","Linux >= 5.6.7 < 5.7","Linux 5.7"],"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T10:36:09.383Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99216","references":[{"url":"https://git.kernel.org/stable/c/f47ce27af80b87cc684d5c12b65506af498ac7e5"},{"url":"https://git.kernel.org/stable/c/3195546a377c2d8d176d837e8baad5ce15d11195"},{"url":"https://git.kernel.org/stable/c/ec31dc39e835ccde0930daccece8c492d28282fc"}],"tags":["cve.org"],"ingestedAt":"2026-10-28T11:09:40.354Z","slug":"CVE-2026-99216","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: Don't reset VMBus connection state on error/exit paths\n\nIn two places, current code forces vmbus_connection.conn_state to\nDISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect()\ncalls vmbus_initiate_unload(), which unloads the VMBus connection\nonly if the conn_state is CONNECTED. Consequently, the connection\nremains and the Hyper-V host might continue to send messages or post\nVMBus interrupts.\n\nThe problem was introduced in commit 74347a99e73ae (\"x86/Hyper-V:\nUnload vmbus channel in hv panic callback\"), in that\nvmbus_initiate_unload() started checking the current connection\nstate before doing the unload. This commit removed some occurrences\nwhere conn_state was forced to DISCONNECTED, but these two remained,\napparently due to an oversight at the time.\n\nFix this by not forcing conn_state to DISCONNECTED during VMBus exit,\nor if a failure occurs when establishing the connection in the first\nplace. Whatever value conn_state has at the time is then read by\nvmbus_initiate_unload() to determine if there is a connection to\nbe unloaded.\n\n## Affected\n\n- `Linux >= 74347a99e73ae00b8385f1209aaea193c670f901 < f47ce27af80b87cc684d5c12b65506af498ac7e5`\n- `Linux >= 74347a99e73ae00b8385f1209aaea193c670f901 < 3195546a377c2d8d176d837e8baad5ce15d11195`\n- `Linux >= 74347a99e73ae00b8385f1209aaea193c670f901 < ec31dc39e835ccde0930daccece8c492d28282fc`\n- `Linux 5e059fc0f054309036d3f612bc8b0a502ca58545`\n- `Linux 9f38f7b46de0747c1909e8c557aa21715dce20c5`\n- `Linux caeeb3787167c884b955404a7e669fd77f267e44`\n- `Linux >= 4.19.118 < 4.20`\n- `Linux >= 5.4.35 < 5.5`\n- `Linux >= 5.6.7 < 5.7`\n- `Linux 5.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}