Incomplete cleanup in Linux kernel - CVE-2026-99216
Published: October 29, 2026
Vulnerability identifier: #VU158364
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-99216
CWE-ID: CWE-459
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to leave a VMBus connection active after teardown, potentially disrupting guest operation through continued host messages or interrupts.
The vulnerability exists due to incomplete cleanup in the Linux kernel Hyper-V VMBus driver when handling connection-establishment errors or driver exit. A local privileged user can trigger an affected cleanup path to leave the connection active because vmbus_connection.conn_state is prematurely set to DISCONNECTED, causing vmbus_initiate_unload() to skip unloading the connection and allowing host messages or VMBus interrupts to continue.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-99216
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.115-2
linux (Debian package) - update to 6.12.115-2