{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-99216 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2026-99216 is a vulnerability in Linux, published on 28 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-99216 and fix it if it is affected.\n\nWhat it is: CVE-2026-99216 is a vulnerability in Linux, published on 28 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-99216 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-99216/ (Markdown: https://insights.sbomify.com/CVE-2026-99216/index.md)","id":"CVE-2026-99216","markdown":"https://insights.sbomify.com/CVE-2026-99216/index.md","name":"CVE-2026-99216","record":{"aliases":["AZL-111386","BELL-CVE-2026-99216","DEBIAN-CVE-2026-99216","GHSA-rfjw-g695-7wxh","UBUNTU-CVE-2026-99216"],"analysis":null,"analysis_generated_by":null,"assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nDrivers: hv: Don't reset VMBus connection state on error/exit paths\n\nIn two places, current code forces vmbus_connection.conn_state to\nDISCONNECTED prior to calling vmbus_disconnect(). But vmbus_disconnect()\ncalls vmbus_initiate_unload(), which unloads the VMBus connection\nonly if the conn_state is CONNECTED. Consequently, the connection\nremains and the Hyper-V host might continue to send messages or post\nVMBus interrupts.\n\nThe problem was introduced in commit 74347a99e73ae (\"x86/Hyper-V:\nUnload vmbus channel in hv panic callback\"), in that\nvmbus_initiate_unload() started checking the current connection\nstate before doing the unload. This commit removed some occurrences\nwhere conn_state was forced to DISCONNECTED, but these two remained,\napparently due to an oversight at the time.\n\nFix this by not forcing conn_state to DISCONNECTED during VMBus exit,\nor if a failure occurs when establishing the connection in the first\nplace. Whatever value conn_state has at the time is then read by\nvmbus_initiate_unload() to determine if there is a connection to\nbe unloaded.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Drivers: hv: Don't reset VMBus connection state on error/exit paths","id":"CVE-2026-99216","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":null,"year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"ipv4: validate checksum_start before completing checksum","id":"CVE-2026-99999"},"packages":[],"prev":{"headline":"power: supply: core: prevent unregistering a power supply while a callback runs","id":"CVE-2026-99215"},"products":["Linux"],"published":"2026-10-28","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-28","vendors":["Linux"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-99216/"}