Is there a patch available for EUVD-2026-111968?

Yes, a patch is available for EUVD-2026-111968. Update the affected software to the latest version immediately.

Linux EUVD-2026-111968

| CVE-2026-99216

2026-10-28 Linux

GHSA-rfjw-g695-7wxh

View

Awaiting Data No severity or threat signals available yet. Label will update when CVSS score is published or threat intelligence arrives.

Patch available

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Drivers: hv: Don't reset VMBus connection state on error/exit paths

In two places, current code forces vmbus_connection.conn_state to DISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect() calls vmbus_initiate_unload(), which unloads the VMBus connection only if the conn_state is CONNECTED. Consequently, the connection remains and the Hyper-V host might continue to send messages or post VMBus interrupts.

The problem was introduced in commit 74347a99e73ae ("x86/Hyper-V: Unload vmbus channel in hv panic callback"), in that vmbus_initiate_unload() started checking the current connection state before doing the unload. This commit removed some occurrences where conn_state was forced to DISCONNECTED, but these two remained, apparently due to an oversight at the time.

Fix this by not forcing conn_state to DISCONNECTED during VMBus exit, or if a failure occurs when establishing the connection in the first place. Whatever value conn_state has at the time is then read by vmbus_initiate_unload() to determine if there is a connection to be unloaded.

Affected VersionsENISA

Linux 5e059fc0f054309036d3f612bc8b0a502ca58545

Linux 5.6.7 <5.7

Linux 74347a99e73ae00b8385f1209aaea193c670f901 <3195546a377c2d8d176d837e8baad5ce15d11195

Linux 74347a99e73ae00b8385f1209aaea193c670f901 <f47ce27af80b87cc684d5c12b65506af498ac7e5

Linux 4.19.118 <4.20

Linux patch: 7.3

Linux 9f38f7b46de0747c1909e8c557aa21715dce20c5

Linux 5.4.35 <5.5

Linux caeeb3787167c884b955404a7e669fd77f267e44

Linux 74347a99e73ae00b8385f1209aaea193c670f901 <ec31dc39e835ccde0930daccece8c492d28282fc

Linux patch: 7.2.13

Linux 5.7

Linux patch: 0

Linux patch: 6.18.59

Affected Packages

euvd linux fix: 4.20, 5.5, 5.7

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Oct 28, 2026 - 11:02 EUVD

CVE Published

Oct 28, 2026 - 10:36 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

Data Quality

2 sources

Confidence: Low

EUVD

CVE.org

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS N/A

Patch available Yes

Active threat No

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Awaiting Data No severity or threat signals available yet. Label will update when CVSS score is published or threat intelligence arrives.

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.