In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on error/exit paths In…
CVE-2026-99216
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on error/exit paths In two places, current code forces vmbusconnection.connstate to DISCONNECTED prior to calling vmbusdisconnect(). But vmbusdisconnect() calls vmbusinitiateunload(), which unloads the VMBus connection only if the connstate is CONNECTED. Consequently, the connection remains and the Hyper-V host might continue to send messages or post VMBus interrupts. The problem was introduced in commit 74347a99e73ae ("x86/Hyper-V: Unload vmbus channel in hv panic callback"), in that vmbusinitiateunload() started checking the current connection state before doing the unload. This commit removed some occurrences where connstate was forced to DISCONNECTED, but these two remained, apparently due to an oversight at the time. Fix this by not forcing connstate to DISCONNECTED during VMBus exit, or if a failure occurs when establishing the connection in the first place. Whatever value connstate has at the time is then read by vmbusinitiateunload() to determine if there is a connection to be unloaded.
Assessment
- CVSS
- 8.4 (v3.1)
- Severity
- High
- EPSS
- 0.16% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 28 October 2026
- Last updated
- 31 October 2026
- Affected
- Linux
- Assigner
- Linux
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
At the source
References
- https://git.kernel.org/stable/c/2939215d57bc8e4189290544fca78f3809ac3ef8
- https://git.kernel.org/stable/c/a0ae955ba9a5067a157ebb8defb4a0a9cb1fc304
- https://git.kernel.org/stable/c/deef3ab5129ae4c45662c957cdab3739eb047fb1
- https://git.kernel.org/stable/c/2e5ffbf1e41abbf6e02ce28115107938f55ff646
- https://git.kernel.org/stable/c/2732210132f92aca0622b5134027990a809279d5
- https://git.kernel.org/stable/c/f47ce27af80b87cc684d5c12b65506af498ac7e5
- https://git.kernel.org/stable/c/3195546a377c2d8d176d837e8baad5ce15d11195
- https://git.kernel.org/stable/c/ec31dc39e835ccde0930daccece8c492d28282fc
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-99216