CVE-2026-90097

Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition

Published Sep 17, 2026 CVSS n/a EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition

The VMBus module initialization function, hv_acpi_init(), currently
does nothing when running in the root partition and root is not nested
in another VM. But the initialization function reports success, so the
VMBus module is indeed loaded. VMBus functionality is not actually
needed, but the VMBus module must be loaded so that hv_vmbus_exists()
can answer correctly. Furthermore, the mshv_root dependency on the
VMBus module is needed as described in the commit message for
840b740a35bf ("mshv: Add conditional VMBus dependency").

Loading the VMBus module without actually initializing it causes
failures if the module should later be unloaded. The module unload code
tries to clean up things that were never initialized, resulting in
memory faults and a panic.

Fix this by having VMBus module exit function perform the same
check for non-nested root partition, and do nothing in such a
case, just like hv_acpi_init().

In the long run, the code that manages the Hyper-V provided SynIC
should be refactored to better coordinate the requirements of
root partition scenarios and normal VM scenarios, and to hopefully
remove the hv_vmbus_exists() dependnecy between mshv_root and
VMBus modules. Preventing the current unload failure scenario is
an expediency until such a refactoring is done.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`7e279d78664aa91107ebff4b03eca367967f5908`	affected	< 321f650493d6b8169dacd4d5d6f63550dce54d6c
`7e279d78664aa91107ebff4b03eca367967f5908`	affected	< 4cc1ba2b31065a48fde14e9d53ad399a3ca32e35
`7e279d78664aa91107ebff4b03eca367967f5908`	affected	< ca1f4a926d08035c52c735a42200e4e5ea548f32
`7e279d78664aa91107ebff4b03eca367967f5908`	affected	< aa17842bbccaeaba7d05c166019d1c96a41bca54
`7e279d78664aa91107ebff4b03eca367967f5908`	affected	< 4c19c302cc577bd6b466f6d8e97971777392c2fa
`7e279d78664aa91107ebff4b03eca367967f5908`	affected	< cee0d90bceae1dee3bcc70f8d6b2ceb5b87deb42

Linux

affected

Version	Status	Constraints
`5.12`	affected	—
`0`	unaffected	< 5.12
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.114`	unaffected	≤ 6.12.*
`6.18.52`	unaffected	≤ 6.18.*
`7.2.6`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[7e279d78664aa91107ebff4b03eca367967f5908,aa17842bbccaeaba7d05c166019d1c96a41bca54)`	affected	code_commit	—
`[7e279d78664aa91107ebff4b03eca367967f5908,4c19c302cc577bd6b466f6d8e97971777392c2fa)`	affected	code_commit	—
`[7e279d78664aa91107ebff4b03eca367967f5908,cee0d90bceae1dee3bcc70f8d6b2ceb5b87deb42)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`5.12`	affected	semver	—
`[0,5.12)`	unaffected	semver	—
`[6.18.52,6.19.0)`	unaffected	semver	—
`[7.2.6,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4904-1	linux-6.12 security update
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.212% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/321f650493d6b8169dacd4d5d6f63550dce54d6c
https://git.kernel.org/stable/c/4c19c302cc577bd6b466f6d8e97971777392c2fa
https://git.kernel.org/stable/c/4cc1ba2b31065a48fde14e9d53ad399a3ca32e35
https://git.kernel.org/stable/c/aa17842bbccaeaba7d05c166019d1c96a41bca54
https://git.kernel.org/stable/c/ca1f4a926d08035c52c735a42200e4e5ea548f32
https://git.kernel.org/stable/c/cee0d90bceae1dee3bcc70f8d6b2ceb5b87deb42

History

Oct 30, 2026 12:45 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/321f650493d6b8169dacd4d5d6f63550dce54d6c

Oct 21, 2026 1:15 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/4cc1ba2b31065a48fde14e9d53ad399a3ca32e35 https://git.kernel.org/stable/c/ca1f4a926d08035c52c735a42200e4e5ea548f32

Sep 17, 2026 4:30 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition The VMBus module initialization function, hv_acpi_init(), currently does nothing when running in the root partition and root is not nested in another VM. But the initialization function reports success, so the VMBus module is indeed loaded. VMBus functionality is not actually needed, but the VMBus module must be loaded so that hv_vmbus_exists() can answer correctly. Furthermore, the mshv_root dependency on the VMBus module is needed as described in the commit message for 840b740a35bf ("mshv: Add conditional VMBus dependency"). Loading the VMBus module without actually initializing it causes failures if the module should later be unloaded. The module unload code tries to clean up things that were never initialized, resulting in memory faults and a panic. Fix this by having VMBus module exit function perform the same check for non-nested root partition, and do nothing in such a case, just like hv_acpi_init(). In the long run, the code that manages the Hyper-V provided SynIC should be refactored to better coordinate the requirements of root partition scenarios and normal VM scenarios, and to hopefully remove the hv_vmbus_exists() dependnecy between mshv_root and VMBus modules. Preventing the current unload failure scenario is an expediency until such a refactoring is done.
Title		Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/4c19c302cc577bd6b466f6d8e97971777392c2fa https://git.kernel.org/stable/c/aa17842bbccaeaba7d05c166019d1c96a41bca54 https://git.kernel.org/stable/c/cee0d90bceae1dee3bcc70f8d6b2ceb5b87deb42