VulnerabilityPublished 17 Sep 2026Updated 30 Oct 2026

CVE-2026-90097: Linux kernel · Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition

Source GCVE Database

Compare

Authoritative record:CVE-2026-90097· High

Not known to be exploited · fixed in cee0d90bceae1dee3bcc70f8d6b2ceb5b87deb42 : patch Linux kernel soon.

Data as of 30 Oct 2026, 19:18 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in cee0d90bceae1dee3bcc70f8d6b2ceb5b87deb42, ca1f4a926d08035c52c735a42200e4e5ea548f32, aa17842bbccaeaba7d05c166019d1c96a41bca54 +3

Exploitation evidence

Disclosed: evidence found.
CVE published 17 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-m2q7-q8rx-27pr

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 7e279d78664aa91107ebff4b03eca367967f5908, < cee0d90bceae1dee3bcc70f8d6b2ceb5b87deb42	Fixed in cee0d90bceae1dee3bcc70f8d6b2ceb5b87deb42
LinuxLinux	Affected ≥ 7e279d78664aa91107ebff4b03eca367967f5908, < ca1f4a926d08035c52c735a42200e4e5ea548f32	Fixed in ca1f4a926d08035c52c735a42200e4e5ea548f32
LinuxLinux	Affected ≥ 7e279d78664aa91107ebff4b03eca367967f5908, < aa17842bbccaeaba7d05c166019d1c96a41bca54	Fixed in aa17842bbccaeaba7d05c166019d1c96a41bca54
LinuxLinux	Affected ≥ 7e279d78664aa91107ebff4b03eca367967f5908, < 321f650493d6b8169dacd4d5d6f63550dce54d6c	Fixed in 321f650493d6b8169dacd4d5d6f63550dce54d6c
LinuxLinux	Affected ≥ 7e279d78664aa91107ebff4b03eca367967f5908, < 4cc1ba2b31065a48fde14e9d53ad399a3ca32e35	Fixed in 4cc1ba2b31065a48fde14e9d53ad399a3ca32e35
LinuxLinux	Affected ≥ 7e279d78664aa91107ebff4b03eca367967f5908, < 4c19c302cc577bd6b466f6d8e97971777392c2fa	Fixed in 4c19c302cc577bd6b466f6d8e97971777392c2fa

AI-suggested

A fix is available that updates the VMBus module exit function to skip cleanup for non-nested root partitions, preventing the unload failure and kernel panic. Users should apply the vendor-provided patch or updated kernel version containing this fix. No additional mitigation is required beyond applying the fix.

Description

CVE-2026-90097 is a vulnerability in the Linux kernel's Hyper-V VMBus driver where the module cleanup code attempts to unload resources that were never initialized in a non-nested root partition scenario. This causes memory faults and kernel panic when the VMBus module is unloaded. The issue arises because the module initialization function reports success without actually initializing the module, leading to inconsistent state during unload. The fix ensures the unload function skips cleanup in this scenario, matching the initialization behavior.

Impact

Unloading the VMBus module in a non-nested root partition causes memory faults and kernel panic due to cleanup of uninitialized resources. This can lead to system instability or crashes if the module unload is triggered in this scenario.

Summary

The Linux kernel's VMBus module initialization function (hv_acpi_init()) does not initialize the module when running in the root partition that is not nested inside another VM, but it reports success, causing the module to be considered loaded. Since the module is loaded but not initialized, unloading it later triggers cleanup code that attempts to free uninitialized resources, resulting in memory faults and kernel panic. The patch modifies the module exit function to skip cleanup in the same non-nested root partition scenario, preventing the unload failure. This is an interim fix pending a future refactor to better coordinate root partition and VM scenarios and remove dependencies between mshv_root and VMBus modules.

References

Community reviews

Loading reviews…