Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

CVE-2026-99216

Gravedad:
Pendiente de análisis
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
28/10/2026
Última modificación:
28/10/2026

Descripción

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Drivers: hv: Don&amp;#39;t reset VMBus connection state on error/exit paths<br /> <br /> In two places, current code forces vmbus_connection.conn_state to<br /> DISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect()<br /> calls vmbus_initiate_unload(), which unloads the VMBus connection<br /> only if the conn_state is CONNECTED. Consequently, the connection<br /> remains and the Hyper-V host might continue to send messages or post<br /> VMBus interrupts.<br /> <br /> The problem was introduced in commit 74347a99e73ae ("x86/Hyper-V:<br /> Unload vmbus channel in hv panic callback"), in that<br /> vmbus_initiate_unload() started checking the current connection<br /> state before doing the unload. This commit removed some occurrences<br /> where conn_state was forced to DISCONNECTED, but these two remained,<br /> apparently due to an oversight at the time.<br /> <br /> Fix this by not forcing conn_state to DISCONNECTED during VMBus exit,<br /> or if a failure occurs when establishing the connection in the first<br /> place. Whatever value conn_state has at the time is then read by<br /> vmbus_initiate_unload() to determine if there is a connection to<br /> be unloaded.

Impacto