Strix
73.2K

CVE-2026-99216

HIGHCVSS 8.4/10EPSS 0.16%

Last modified

CVE-2026-99216 is a high-severity vulnerability rated 8.4/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on error/exit paths In two places, current code forces vmbus_connection.conn_state to DISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect() calls vmbus_initiate_unload(), which unloads the VMBus connection only if the conn_state is CONNECTED. EPSS estimates a 0.16% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on error/exit paths In two places, current code forces vmbus_connection.conn_state to DISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect() calls vmbus_initiate_unload(), which unloads the VMBus connection only if the conn_state is CONNECTED. Consequently, the connection remains and the Hyper-V host might continue to send messages or post VMBus interrupts. The problem was introduced in commit 74347a99e73ae ("x86/Hyper-V: Unload vmbus channel in hv panic callback"), in that vmbus_initiate_unload() started checking the current connection state before doing the unload. This commit removed some occurrences where conn_state was forced to DISCONNECTED, but these two remained, apparently due to an oversight at the time. Fix this by not forcing conn_state to DISCONNECTED during VMBus exit, or if a failure occurs when establishing the connection in the first place. Whatever value conn_state has at the time is then read by vmbus_initiate_unload() to determine if there is a connection to be unloaded.

Metrics

CVSS 3.1
8.4/10

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.16%

5.2th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 74347a99e73ae00b8385f1209aaea193c670f901, < 2939215d57bc8e4189290544fca78f3809ac3ef8; >= 74347a99e73ae00b8385f1209aaea193c670f901, < a0ae955ba9a5067a157ebb8defb4a0a9cb1fc304; >= 74347a99e73ae00b8385f1209aaea193c670f901, < deef3ab5129ae4c45662c957cdab3739eb047fb1; >= 74347a99e73ae00b8385f1209aaea193c670f901, < 2e5ffbf1e41abbf6e02ce28115107938f55ff646; >= 74347a99e73ae00b8385f1209aaea193c670f901, < 2732210132f92aca0622b5134027990a809279d5; >= 74347a99e73ae00b8385f1209aaea193c670f901, < f47ce27af80b87cc684d5c12b65506af498ac7e5; >= 74347a99e73ae00b8385f1209aaea193c670f901, < 3195546a377c2d8d176d837e8baad5ce15d11195; >= 74347a99e73ae00b8385f1209aaea193c670f901, < ec31dc39e835ccde0930daccece8c492d28282fc; 5e059fc0f054309036d3f612bc8b0a502ca58545; 9f38f7b46de0747c1909e8c557aa21715dce20c5; caeeb3787167c884b955404a7e669fd77f267e44; >= 4.19.118, < 4.20; >= 5.4.35, < 5.5; >= 5.6.7, < 5.7
LinuxLinux5.7

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-99216?
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on error/exit paths In two places, current code forces vmbus_connection.conn_state to DISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect() calls vmbus_initiate_unload(), which unloads the VMBus connection only if the conn_state is CONNECTED. Consequently, the connection remains and the Hyper-V host might continue to send messages or post VMBus interrupts. The problem was introduced in commit 74347a99e73ae ("x86/Hyper-V: Unload vmbus channel in hv panic callback"), in that vmbus_initiate_unload() started checking the current connection state before doing the unload. This commit removed some occurrences where conn_state was forced to DISCONNECTED, but these two remained, apparently due to an oversight at the time. Fix this by not forcing conn_state to DISCONNECTED during VMBus exit, or if a failure occurs when establishing the connection in the first place. Whatever value conn_state has at the time is then read by vmbus_initiate_unload() to determine if there is a connection to be unloaded.
How severe is CVE-2026-99216?
CVE-2026-99216 has a CVSS score of 8.4/10 (HIGH severity). The EPSS model estimates a 0.16% probability of exploitation in the next 30 days.
How do I fix CVE-2026-99216?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-99216?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST