Linux kernel: Improper connection state handling in Hyper-V VMBus driver
Summary
The Linux kernel VMBus driver (drivers/hv) forces the connection state to DISCONNECTED on two error and exit paths. This prevents the connection from being unloaded, so the Hyper-V host may keep sending messages and posting interrupts to the guest. The issue affects Linux guests running on Hyper-V or Azure. An attacker needs local access and privileges within the guest to exploit it, so the impact is mainly on guest integrity and availability.
Affected
- Linux kernel versions from commit 74347a99e73ae (included from 5.7 onward), according to OSV and the CNA data. Source data conflicts on exact ranges.
- Linux kernel stable branches before the fixed releases listed below.
- Distribution kernels are not verified. Ubuntu lists its packages as Needs evaluation.
Fixed in
- Upstream stable fixes are listed in the CVE record (for example commits ec31dc39e835ccde0930daccece8c492d28282fc and f47ce27af80b87cc684d5c12b65506af498ac7e5).
- According to OSV, fixed in 5.10.273, 5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.59 and 7.2.13.
- Fixed builds of specific distributions: Unknown.
Workaround
None documented. Install a fixed kernel and reboot.
Exploitation
Not known to be exploited. A third-party tracker reports no KEV listing and no public exploit. No public proof of concept was found. The fix was identified through code review.
Our recommendation
- List Linux VMs running on Hyper-V or Azure.
- Check your distribution's kernel advisory for CVE-2026-99216 and the fixed kernel version.
- Install the fixed kernel and schedule a reboot.
- Prioritise this on multi-tenant hosts or hosts running untrusted workloads.
- Treat as routine kernel patching otherwise.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record via Ubuntu ubuntu.com
- Kernel patch posting (Michael Kelley) www.mail-archive.com
- Stable commit ec31dc39e835ccde0930daccece8c492d28282fc git.kernel.org
- Stable commit f47ce27af80b87cc684d5c12b65506af498ac7e5 git.kernel.org
- Stable commit 2939215d57bc8e4189290544fca78f3809ac3ef8 git.kernel.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:56.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on error/exit paths In two places, current code forces vmbus_connection.conn_state to DISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect() calls vmbus_initiate_unload(), which unloads the VMBus connection only if the conn_state is CONNECTED. Consequently, the connection remains and the Hyper-V host might continue to send messages or post VMBus interrupts. The problem was introduced in commit 74347a99e73ae ("x86/Hyper-V: Unload vmbus channel in hv panic callback"), in that vmbus_initiate_unload() started checking the current connection state before doing the unload. This commit removed some occurrences where conn_state was forced to DISCONNECTED, but these two remained, apparently due to an oversight at the time. Fix this by not forcing conn_state to DISCONNECTED during VMBus exit, or if a failure occurs when establishing the connection in the first place. Whatever value conn_state has at the time is then read by vmbus_initiate_unload() to determine if there is a connection to be unloaded.
NVD references (8)
- https://git.kernel.org/stable/c/2732210132f92aca0622b5134027990a809279d5
- https://git.kernel.org/stable/c/2939215d57bc8e4189290544fca78f3809ac3ef8
- https://git.kernel.org/stable/c/2e5ffbf1e41abbf6e02ce28115107938f55ff646
- https://git.kernel.org/stable/c/3195546a377c2d8d176d837e8baad5ce15d11195
- https://git.kernel.org/stable/c/a0ae955ba9a5067a157ebb8defb4a0a9cb1fc304
- https://git.kernel.org/stable/c/deef3ab5129ae4c45662c957cdab3739eb047fb1
- https://git.kernel.org/stable/c/ec31dc39e835ccde0930daccece8c492d28282fc
- https://git.kernel.org/stable/c/f47ce27af80b87cc684d5c12b65506af498ac7e5
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.