In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Avoid infinite retry loop in initvpindex() There is a…
CVE-2026-99251
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Avoid infinite retry loop in initvpindex() There is a retry loop in initvpindex() where the CPUs from a certain node are stripped out if they have already been in the allocated cpumask or not in HKTYPEMANAGEDIRQ housekeeping cpumask. If there is no CPU left, the allocated cpumask is ignored and the process is retried again. However, if the HKTYPEMANAGEDIRQ housekeeping cpumask turns out not to contain any CPU in that particular node, that will become an infinite retry loop. This particular problem was reported by sashiko [1]. This should rarely happen, but we still need to guard against this. Fix this infinite loop problem by also skipping NUMA node that has no housekeeping CPU in the inner while loop of initvpindex(). Also update the early abort check to check for the absence of online housekeeping CPUs instead of just the emptiness of the cpumask. As the outer for loop will only be reached if the housekeeping cpumask has at least one online CPU, a NUMA node with housekeeping CPUs will eventually be found.
Assessment
- CVSS
- Not yet scored
- Severity
- Unscored
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 3 November 2026
- Last updated
- 3 November 2026
- Assigner
- Linux
At the source
References
- https://git.kernel.org/stable/c/b3993f6dc106ff416c7a613c631e1e0af451aed7
- https://git.kernel.org/stable/c/f561392afb44a8a42c54c1cfd3f33dace0b50537
- https://git.kernel.org/stable/c/15dd3429f0e76ca071657e480cb7e6ff3a1af730
- https://git.kernel.org/stable/c/7141331f2d245efc07175802a6bf76badec871ed
- https://git.kernel.org/stable/c/95fec47cdbf747b81ab22affd7252dda6050ad0c
- https://git.kernel.org/stable/c/32ea0a33e3a0fb7c10c601b43e1b2f6c06a3f5fd
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-99251