Cloudanix VulnDB

CVE-2026-99216

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux running on Microsoft Hyper-V can leave an internal communication link open when the system thinks it has closed it, potentially allowing the host to keep talking to the guest after shutdown or errors.

Exploitation
Other
Attacker needs
None
Complexity
Theoretical
Impact
Other
Component
OS kernel
Class
Other
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Incorrectly forcing VMBus connection state to DISCONNECTED before disconnect calls prevents vmbus_initiate_unload from unloading an active connection, leaving the Hyper-V host able to continue sending messages and interrupts after expected teardown or on initial connection failure paths.

Why it matters to the business

Linux guests running under Hyper-V may experience lingering host-guest communication channels that survive expected shutdown or error paths, potentially allowing continued host interaction after the guest believes the link is closed.

How an attack unfolds

An attacker with control of the Hyper-V host or the ability to induce VMBus exit or connection-failure paths in the guest triggers the flawed state transition; because conn_state is forced to DISCONNECTED, vmbus_initiate_unload skips unloading, leaving the connection and its interrupt delivery path intact for subsequent host-initiated messages.

How to fix it

Apply the upstream kernel fix that removes the erroneous conn_state = DISCONNECTED assignments before vmbus_disconnect calls; rebuild and deploy updated kernel packages to affected Hyper-V Linux guests.

How to confirm the fix worked

Confirm the corrected source no longer contains the two forced DISCONNECTED assignments prior to vmbus_disconnect, boot the patched kernel under Hyper-V, and verify that connection teardown and error paths properly allow unload when the state indicates an active connection.

Typical attack path

  1. Trigger VMBus exit path or connection establishment failure in the Linux guest
  2. Code path forces conn_state to DISCONNECTED before calling vmbus_disconnect
  3. vmbus_initiate_unload checks state and skips unload because state is not CONNECTED
  4. Hyper-V host retains ability to post VMBus messages and interrupts to the guest

How to detect it

Inspect kernel logs around VMBus initialization and teardown for unexpected continued message or interrupt activity after disconnect attempts; examine source history or running kernel for the presence of the two erroneous conn_state assignments introduced by the referenced prior commit.

What your security team should do

  • Prioritize patching Linux kernels on Hyper-V guests within the next maintenance window
  • Review Hyper-V guest kernel configurations for any custom VMBus handling that may interact with this path
  • Monitor upstream stable kernel releases for the merged fix and backports

The record

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Don't reset VMBus connection state on error/exit paths In two places, current code forces vmbus_connection.conn_state to DISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect() calls vmbus_initiate_unload(), which unloads the VMBus connection only if the conn_state is CONNECTED. Consequently, the connection remains and the Hyper-V host might continue to send messages or post VMBus interrupts. The problem was introduced in commit 74347a99e73ae ("x86/Hyper-V: Unload vmbus channel in hv panic callback"), in that vmbus_initiate_unload() started checking the current connection state before doing the unload. This commit removed some occurrences where conn_state was forced to DISCONNECTED, but these two remained, apparently due to an oversight at the time. Fix this by not forcing conn_state to DISCONNECTED during VMBus exit, or if a failure occurs when establishing the connection in the first place. Whatever value conn_state has at the time is then read by vmbus_initiate_unload() to determine if there is a connection to be unloaded.

Affected packages

Ecosystem Package Introduced Fixed