Skip to main content

Linux EUVDEUVD-2026-115762

| CVE-2026-99251
2026-11-03 Linux GHSA-pccv-95f7-7fv3
View
Awaiting Data No severity or threat signals available yet. Label will update when CVSS score is published or threat intelligence arrives.
Patch available

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Drivers: hv: Avoid infinite retry loop in init_vp_index()

There is a retry loop in init_vp_index() where the CPUs from a certain node are stripped out if they have already been in the allocated cpumask or not in HK_TYPE_MANAGED_IRQ housekeeping cpumask. If there is no CPU left, the allocated cpumask is ignored and the process is retried again. However, if the HK_TYPE_MANAGED_IRQ housekeeping cpumask turns out not to contain any CPU in that particular node, that will become an infinite retry loop. This particular problem was reported by sashiko [1]. This should rarely happen, but we still need to guard against this.

Fix this infinite loop problem by also skipping NUMA node that has no housekeeping CPU in the inner while loop of init_vp_index(). Also update the early abort check to check for the absence of online housekeeping CPUs instead of just the emptiness of the cpumask. As the outer for loop will only be reached if the housekeeping cpumask has at least one online CPU, a NUMA node with housekeeping CPUs will eventually be found.

Affected VersionsENISA

Linux patch: 7.3
Linux 5.19
Linux patch: 6.18.59
Linux patch: 7.2.13
Linux 6640b5df1a38801be6d0595c8cd2177d968d7ee0 <32ea0a33e3a0fb7c10c601b43e1b2f6c06a3f5fd
Linux 6640b5df1a38801be6d0595c8cd2177d968d7ee0 <b3993f6dc106ff416c7a613c631e1e0af451aed7
Linux patch: 6.12.115
Linux patch: 6.6.161
Linux 6640b5df1a38801be6d0595c8cd2177d968d7ee0 <f561392afb44a8a42c54c1cfd3f33dace0b50537
Linux 6640b5df1a38801be6d0595c8cd2177d968d7ee0 <7141331f2d245efc07175802a6bf76badec871ed
Linux patch: 6.1.191
Linux 6640b5df1a38801be6d0595c8cd2177d968d7ee0 <95fec47cdbf747b81ab22affd7252dda6050ad0c
Linux 6640b5df1a38801be6d0595c8cd2177d968d7ee0 <15dd3429f0e76ca071657e480cb7e6ff3a1af730
Linux patch: 0

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources

No credit card · 7-day full trial

Lifecycle Timeline

2
Patch available
Nov 03, 2026 - 12:16 EUVD
CVE Published
Nov 03, 2026 - 11:18 cve.org
UNKNOWN (no severity yet)

Threat Intelligence Overview

Data Quality
1 sources
Confidence: Low

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity Not scored yet
CISA KEV No
Public POC No
EPSS N/A
Patch available Yes
Active threat No
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.
Awaiting Data No severity or threat signals available yet. Label will update when CVSS score is published or threat intelligence arrives.

Attack Technique

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy