CVE-2026-99216: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-99216 is a denial-of-service vulnerability in the Linux kernel's Hyper-V VMBus driver (Drivers: hv) caused by incorrect connection state management on error and exit paths. The flaw causes vmbus_connection.conn_state to be prematurely forced to DISCONNECTED before calling vmbus_disconnect(), preventing the connection from being properly unloaded and allowing the Hyper-V host to continue sending messages or posting VMBus interrupts. Affected Linux kernel versions include 4.19.118–4.20, 5.4.35–5.5, 5.6.7–5.7, and 5.7 (mainline). The vulnerability was published on October 28, 2026, with patches available. The CVSS base score is estimated as Medium (0.0 formally recorded; CVSS category estimate: MEDIUM) (Github Advisory, Feedly).

The root cause is a logic error introduced by commit 74347a99e73ae ("x86/Hyper-V: Unload vmbus channel in hv panic callback"), which made vmbus_initiate_unload() conditional on conn_state being CONNECTED. Two code paths that previously forced conn_state to DISCONNECTED before calling vmbus_disconnect() were not updated, leaving the VMBus connection active after a disconnect attempt. This falls under improper state management (related to CWE-664: Improper Control of a Resource Through its Lifetime). The fix removes the forced state reset so that vmbus_initiate_unload() can correctly read the actual connection state and perform the unload when appropriate (Github Advisory).

Exploitation of this vulnerability can result in an orphaned VMBus connection state, where the Hyper-V host continues to send unsolicited messages or post VMBus interrupts to a guest VM that has attempted to disconnect. This can lead to unexpected system behavior, instability, or crashes (denial of service) on affected Linux guest VMs running under Hyper-V. The impact is limited to availability; there is no evidence of confidentiality or integrity compromise (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The vulnerability requires local access to trigger error or exit paths in VMBus connection handling. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Github Advisory, Feedly).

Apply the kernel patches that remove the forced conn_state = DISCONNECTED reset in VMBus error and exit paths. Fixed commits are available at f47ce27af80b (for the 4.19.x stable branch), 3195546a377c (for the 5.4.x stable branch), and ec31dc39e835 (for the 5.6.x stable branch). Patched stable releases include kernel versions 6.18.59+ and 7.2.13+, with the mainline fix targeting 7.3. As an interim measure, monitor VMBus error logs and minimize conditions that trigger VMBus connection error/exit paths on affected guest VMs (Github Advisory, Feedly).