---
id: CVE-2026-99216
title: 'Drivers: hv: Don''t reset VMBus connection state on error/exit paths'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Drivers: hv: Don't reset VMBus connection state on error/exit paths

  In two places, current code forces vmbus_connection.conn_state to
  DISCONNECTED prior to calling vmb…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 74347a99e73ae00b8385f1209aaea193c670f901 <
    f47ce27af80b87cc684d5c12b65506af498ac7e5
  - >-
    Linux >= 74347a99e73ae00b8385f1209aaea193c670f901 <
    3195546a377c2d8d176d837e8baad5ce15d11195
  - >-
    Linux >= 74347a99e73ae00b8385f1209aaea193c670f901 <
    ec31dc39e835ccde0930daccece8c492d28282fc
  - Linux 5e059fc0f054309036d3f612bc8b0a502ca58545
  - Linux 9f38f7b46de0747c1909e8c557aa21715dce20c5
  - Linux caeeb3787167c884b955404a7e669fd77f267e44
  - Linux >= 4.19.118 < 4.20
  - Linux >= 5.4.35 < 5.5
  - Linux >= 5.6.7 < 5.7
  - Linux 5.7
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T10:36:09.383Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99216'
references:
  - url: 'https://git.kernel.org/stable/c/f47ce27af80b87cc684d5c12b65506af498ac7e5'
  - url: 'https://git.kernel.org/stable/c/3195546a377c2d8d176d837e8baad5ce15d11195'
  - url: 'https://git.kernel.org/stable/c/ec31dc39e835ccde0930daccece8c492d28282fc'
tags:
  - cve.org
ingestedAt: '2026-10-28T11:09:40.354Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Drivers: hv: Don't reset VMBus connection state on error/exit paths

In two places, current code forces vmbus_connection.conn_state to
DISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect()
calls vmbus_initiate_unload(), which unloads the VMBus connection
only if the conn_state is CONNECTED. Consequently, the connection
remains and the Hyper-V host might continue to send messages or post
VMBus interrupts.

The problem was introduced in commit 74347a99e73ae ("x86/Hyper-V:
Unload vmbus channel in hv panic callback"), in that
vmbus_initiate_unload() started checking the current connection
state before doing the unload. This commit removed some occurrences
where conn_state was forced to DISCONNECTED, but these two remained,
apparently due to an oversight at the time.

Fix this by not forcing conn_state to DISCONNECTED during VMBus exit,
or if a failure occurs when establishing the connection in the first
place. Whatever value conn_state has at the time is then read by
vmbus_initiate_unload() to determine if there is a connection to
be unloaded.

## Affected

- `Linux >= 74347a99e73ae00b8385f1209aaea193c670f901 < f47ce27af80b87cc684d5c12b65506af498ac7e5`
- `Linux >= 74347a99e73ae00b8385f1209aaea193c670f901 < 3195546a377c2d8d176d837e8baad5ce15d11195`
- `Linux >= 74347a99e73ae00b8385f1209aaea193c670f901 < ec31dc39e835ccde0930daccece8c492d28282fc`
- `Linux 5e059fc0f054309036d3f612bc8b0a502ca58545`
- `Linux 9f38f7b46de0747c1909e8c557aa21715dce20c5`
- `Linux caeeb3787167c884b955404a7e669fd77f267e44`
- `Linux >= 4.19.118 < 4.20`
- `Linux >= 5.4.35 < 5.5`
- `Linux >= 5.6.7 < 5.7`
- `Linux 5.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.