Executive brief
The Linux kernel's Hyper-V VMBus module has a bug where it loads without fully initializing on certain systems (non-nested root partitions), but then crashes with memory faults when unloaded because the cleanup code attempts to tear down components that were never set up. This can cause system instability when the module is removed.
Technical details
The vulnerability is a use-after-free / uninitialized cleanup bug in the Hyper-V VMBus kernel module (drivers/hv/vmbus_drv.c). The hv_acpi_init() function returns success without performing initialization when running on a non-nested root partition, but the vmbus_exit() function still attempts full cleanup, accessing uninitialized structures and causing a kernel panic. The fix adds a matching guard in vmbus_exit() to skip cleanup when running on a non-nested root partition. The bug only manifests during module unload, and requires local system access or administrator privileges to trigger (module removal).
Affected products
- Linux Linux kernel Versions with the VMBus module (affected by commit 7e279d78664aa, fixed in commit cee0d90bceae1dee3bcc70f8d6b2ceb5b87deb42)
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched: Fix merged upstream