Executive brief
A vulnerability in the Linux kernel's storage driver for Hyper-V environments can cause system instability or a complete lock-up. This issue occurs specifically when the system is configured with real-time preemption (PREEMPT_RT) enabled. An exploit could lead to a denial-of-service, impacting the availability of virtual machines and the services they host.
Technical details
A vulnerability exists in the 'storvsc' SCSI driver within the Linux kernel when running on Hyper-V with PREEMPT_RT enabled. The root cause is a 'scheduling while atomic' bug where the driver calls 'get_cpu()', which disables preemption, while subsequently attempting to acquire a spinlock ('hv_ringbuffer_write') that is converted to a sleepable rt-mutex under PREEMPT_RT. This violation of atomic context requirements leads to kernel splats and system hangs. The fix replaces 'get_cpu()' and 'put_cpu()' with 'migrate_disable()' and 'migrate_enable()' to ensure the task remains on the same CPU without disabling preemption. Patches have been released across multiple stable kernel branches.
Affected products
- Linux Linux kernel PREEMPT_RT enabled versions
Timeline
- 2026-01-29: patched: Initial patch authored by Jan Kiszka
- 2026-05-08: disclosed: CVE-2026-43475 published
References
- https://git.kernel.org/stable/c/57297736c08233987e5d29ce6584c6ca2a831b12
- https://git.kernel.org/stable/c/91ab59f76d0866079420ebff1c7959fcd87a242e
- https://git.kernel.org/stable/c/b82462af23e45e066dd56d2736ea70159a6ad647
- https://git.kernel.org/stable/c/c2e73d8acd056347a70047e6be7cd98e0e811dfa
- https://git.kernel.org/stable/c/c7984d196476adcbd51c0ce386d7e90277198d57
- https://git.kernel.org/stable/c/cf00cb15f2515e38d3b7571bf6800b7c6ce70a84
- https://git.kernel.org/stable/c/e7919a293f9b6101e38bde0d8613daea6c9955df