Is CVE-2026-99216 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-99216 being exploited in the wild.

How severe is CVE-2026-99216?

Informational severity, published 28 October 2026.

Which products and versions are affected?

Linux Kernel multiple versions with Hyper-V support; fixed in kernel versions following commit ec31dc39e835ccde0930daccece8c492d28282fc.

Is there a fix for CVE-2026-99216?

A patch was published on 2026-09-13: upstream patch commit ec31dc39e835ccde0930daccece8c492d28282fc Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-99216 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-99216?

Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-99216: Linux kernel Hyper-V VMBus connection state logic error

CVE-2026-99216 · Severity: info · Published 2026-10-28

The Linux kernel's Hyper-V VMBus driver contains a logic error in connection state management that can leave the VMBus connection active when it should be properly closed. When the system shuts down or the initial connection attempt fails, the code incorrectly marks the connection as disconnected before attempting the actual disconnect, which causes the disconnect operation to skip necessary cleanup. This leaves the Hyper-V host potentially sending messages or interrupts to a system that believes it has disconnected, leading to resource leaks and possible system instability.

Technologies: Linux Kernel. Vendors: Linux.

Quick answers

Is CVE-2026-99216 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-99216 being exploited in the wild.
How severe is CVE-2026-99216?: Informational severity, published 28 October 2026.
Which products and versions are affected?: Linux Kernel multiple versions with Hyper-V support; fixed in kernel versions following commit ec31dc39e835ccde0930daccece8c492d28282fc.
Is there a fix for CVE-2026-99216?: A patch was published on 2026-09-13: upstream patch commit ec31dc39e835ccde0930daccece8c492d28282fc Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-99216 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-99216?: Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a state machine error in the VMBus connection driver (drivers/hv/connection.c and drivers/hv/vmbus_drv.c). Two code paths force vmbus_connection.conn_state to DISCONNECTED before calling vmbus_disconnect(), but vmbus_disconnect() invokes vmbus_initiate_unload() which only performs cleanup if conn_state is CONNECTED. This causes the actual connection to remain open with the Hyper-V host continuing to send messages or post interrupts. The fix removes the premature state transitions in the error cleanup path during vmbus_connect() and the exit path in vmbus_exit().

Affected products

Linux Linux kernel multiple versions with Hyper-V support; fixed in kernel versions following commit ec31dc39e835ccde0930daccece8c492d28282fc

Timeline

2026-10-28: disclosed
2026-09-13: patched: upstream patch commit ec31dc39e835ccde0930daccece8c492d28282fc

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.