{"id":"CVE-2026-99216","kind":"vulnerability","aliases":["CVE-2026-99216"],"related":[],"title":"Linux Hyper-V VMBus: connection state reset leaves host messages flowing","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: Don't reset VMBus connection state on error/exit paths\n\nIn two places, current code forces vmbus_connection.conn_state to\nDISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect()\ncalls vmbus_initiate_unload(), which unloads the VMBus connection\nonly if the conn_state is CONNECTED. Consequently, the connection\nremains and the Hyper-V host might continue to send messages or post\nVMBus interrupts.\n\nThe problem was introduced in commit 74347a99e73ae (\"x86/Hyper-V:\nUnload vmbus channel in hv panic callback\"), in that\nvmbus_initiate_unload() started checking the current connection\nstate before doing the unload. This commit removed some occurrences\nwhere conn_state was forced to DISCONNECTED, but these two remained,\napparently due to an oversight at the time.\n\nFix this by not forcing conn_state to DISCONNECTED during VMBus exit,\nor if a failure occurs when establishing the connection in the first\nplace. Whatever value conn_state has at the time is then read by\nvmbus_initiate_unload() to determine if there is a connection to\nbe unloaded.","summary":"In the Linux kernel's Hyper-V VMBus driver, error and exit paths force the connection state to DISCONNECTED before vmbus_disconnect() runs, so the unload is skipped and the Hyper-V host can keep sending messages and VMBus interrupts. The sources do not describe a demonstrated attacker exploit or a concrete impact beyond that unclean state.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hyper-v","infrastructure","linux-kernel","vmbus"],"not_affected_if":["bare-metal","non-hyper-v-hypervisor"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-28T11:17:43+00:00","first_seen_at":"2026-10-28T11:32:38+00:00","triaged_at":"2026-10-28T11:33:44+00:00","updated_at":"2026-10-28T11:33:44+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-28T11:33:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Linux Hyper-V VMBus: connection state reset leaves host messages flowing","impact":"low","summary":"In the Linux kernel's Hyper-V VMBus driver, error and exit paths force the connection state to DISCONNECTED before vmbus_disconnect() runs, so the unload is skipped and the Hyper-V host can keep sending messages and VMBus interrupts. The sources do not describe a demonstrated attacker exploit or a concrete impact beyond that unclean state.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","hyper-v","vmbus"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the upstream kernel commit and the NVD entry for CVSS, the affected kernel version ranges, and whether the stale connection enables any concrete attack from the host side.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["bare-metal","non-hyper-v-hypervisor"],"who_is_affected":"Linux guests running on Microsoft Hyper-V that load the VMBus driver are the systems this kernel fix concerns. Bare-metal Linux hosts, non-Hyper-V hypervisors, and systems without the hv VMBus driver are not described as affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000619,"input_tokens":3636,"output_tokens":511,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99216':15A,18A '74347a99e73ae':166C 'appar':206C 'attack':76B 'beyond':82B 'call':119C,125C 'callback':174C 'channel':170C 'check':181C 'code':111C 'commit':165C,191C 'concret':80B 'conn':137C,196C,219C,241C 'connect':6A,43B,102C,133C,140C,143C,184C,234C,260C 'consequ':141C 'continu':152C 'current':110C,183C 'cve':13A,16A 'demonstr':75B 'describ':73B 'determin':255C 'disconnect':46B,49B,116C,121C,124C,201C,222C 'driver':36B,96C 'due':207C 'error':37B 'error/exit':105C 'establish':232C 'exit':39B,225C 'exploit':77B 'failur':229C 'first':237C 'fix':214C 'flow':12A 'follow':91C 'forc':41B,112C,199C,218C 'host':10A,61B,150C 'hv':97C,172C 'hyper':3A,20B,33B,59B,148C 'hyper-v':2A,19B,32B,58B,147C 'impact':81B 'infrastructur':22B 'initi':127C,178C,252C 'interrupt':68B,159C 'introduc':163C 'keep':63B 'kernel':25B,30B,89C 'leav':9A 'linux':1A,24B,29B,88C 'linux-kernel':23B 'messag':11A,65B,155C 'might':151C 'occur':230C 'occurr':194C 'oversight':210C 'panic':173C 'path':40B,106C 'place':109C,238C 'post':157C 'prior':117C 'problem':161C 'read':249C 'remain':144C,205C 'remov':192C 'reset':8A,100C 'resolv':95C 'run':50B 'send':64B,154C 'skip':55B 'sourc':70B 'start':180C 'state':7A,44B,85B,103C,114C,138C,185C,197C,220C,242C 'time':213C,246C 'two':108C,204C 'unclean':84B 'unload':53B,128C,130C,168C,179C,189C,253C,263C 'v':4A,21B,34B,60B,149C 'valu':240C 'vmbus':5A,26B,35B,48B,67B,101C,120C,123C,126C,132C,158C,169C,177C,224C,251C 'vmbus_connection.conn':113C 'vulner':92C 'whatev':239C 'x86/hyper-v':167C","nicknames":[],"mitigations":[],"who_affected":"Linux guests running on Microsoft Hyper-V that load the VMBus driver are the systems this kernel fix concerns. Bare-metal Linux hosts, non-Hyper-V hypervisors, and systems without the hv VMBus driver are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:43+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99216","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99216","severity":null,"published_at":"2026-10-28T11:17:43+00:00","modified_at":"2026-10-28T11:17:43+00:00","first_seen_at":"2026-10-28T11:32:38+00:00","fetched_at":"2026-10-28T11:32:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}