{"id":"CVE-2026-99216","revision":"1af19a637638463084564d692ae2a663","records":[{"revision":"1af19a637638463084564d692ae2a663","observedAt":"2026-10-28T11:27:43.363+00:00","statement":{"source":"cve-program","id":"CVE-2026-99216","aliases":[],"title":"Drivers: hv: Don't reset VMBus connection state on error/exit paths","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: Don't reset VMBus connection state on error/exit paths\n\nIn two places, current code forces vmbus_connection.conn_state to\nDISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect()\ncalls vmbus_initiate_unload(), which unloads the VMBus connection\nonly if the conn_state is CONNECTED. Consequently, the connection\nremains and the Hyper-V host might continue to send messages or post\nVMBus interrupts.\n\nThe problem was introduced in commit 74347a99e73ae (\"x86/Hyper-V:\nUnload vmbus channel in hv panic callback\"), in that\nvmbus_initiate_unload() started checking the current connection\nstate before doing the unload. This commit removed some occurrences\nwhere conn_state was forced to DISCONNECTED, but these two remained,\napparently due to an oversight at the time.\n\nFix this by not forcing conn_state to DISCONNECTED during VMBus exit,\nor if a failure occurs when establishing the connection in the first\nplace. Whatever value conn_state has at the time is then read by\nvmbus_initiate_unload() to determine if there is a connection to\nbe unloaded.","state":0,"publishedAt":"2026-10-28T10:36:09.383+00:00","modifiedAt":"2026-10-28T10:36:09.383+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/hv/connection.c\",\n                        \"drivers/hv/vmbus_drv.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"74347a99e73ae00b8385f1209aaea193c670f901\",\n                            \"lessThan\": \"f47ce27af80b87cc684d5c12b65506af498ac7e5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"74347a99e73ae00b8385f1209aaea193c670f901\",\n                            \"lessThan\": \"3195546a377c2d8d176d837e8baad5ce15d11195\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"74347a99e73ae00b8385f1209aaea193c670f901\",\n                            \"lessThan\": \"ec31dc39e835ccde0930daccece8c492d28282fc\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5e059fc0f054309036d3f612bc8b0a502ca58545\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9f38f7b46de0747c1909e8c557aa21715dce20c5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"caeeb3787167c884b955404a7e669fd77f267e44\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4.19.118\",\n                            \"lessThan\": \"4.20\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.35\",\n                            \"lessThan\": \"5.5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.6.7\",\n                            \"lessThan\": \"5.7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/hv/connection.c\",\n                        \"drivers/hv/vmbus_drv.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.7\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.7\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.59\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.13\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/f47ce27af80b87cc684d5c12b65506af498ac7e5","https://git.kernel.org/stable/c/3195546a377c2d8d176d837e8baad5ce15d11195","https://git.kernel.org/stable/c/ec31dc39e835ccde0930daccece8c492d28282fc"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99216","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-99216","identifiers":["CVE-2026-99216"]},"retained":false,"historicalAffected":[]}],"coverage":[]}