VulnerabilityPublished 3 Nov 2026

CVE-2026-99251: Linux kernel · Drivers: hv: Avoid infinite retry loop in init_vp_index()

Source GCVE Database

Compare

Authoritative record:CVE-2026-99251· Medium

Not known to be exploited · fixed in f561392afb44a8a42c54c1cfd3f33dace0b50537 : update Linux kernel when convenient.

Data as of 3 Nov 2026, 13:15 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in f561392afb44a8a42c54c1cfd3f33dace0b50537, b3993f6dc106ff416c7a613c631e1e0af451aed7, 7141331f2d245efc07175802a6bf76badec871ed +3

Exploitation evidence

Disclosed: evidence found.
CVE published 3 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 3 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-pccv-95f7-7fv3

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 6640b5df1a38801be6d0595c8cd2177d968d7ee0, < f561392afb44a8a42c54c1cfd3f33dace0b50537	Fixed in f561392afb44a8a42c54c1cfd3f33dace0b50537
LinuxLinux	Affected ≥ 6640b5df1a38801be6d0595c8cd2177d968d7ee0, < b3993f6dc106ff416c7a613c631e1e0af451aed7	Fixed in b3993f6dc106ff416c7a613c631e1e0af451aed7
LinuxLinux	Affected ≥ 6640b5df1a38801be6d0595c8cd2177d968d7ee0, < 7141331f2d245efc07175802a6bf76badec871ed	Fixed in 7141331f2d245efc07175802a6bf76badec871ed
LinuxLinux	Affected ≥ 6640b5df1a38801be6d0595c8cd2177d968d7ee0, < 95fec47cdbf747b81ab22affd7252dda6050ad0c	Fixed in 95fec47cdbf747b81ab22affd7252dda6050ad0c
LinuxLinux	Affected ≥ 6640b5df1a38801be6d0595c8cd2177d968d7ee0, < 32ea0a33e3a0fb7c10c601b43e1b2f6c06a3f5fd	Fixed in 32ea0a33e3a0fb7c10c601b43e1b2f6c06a3f5fd
LinuxLinux	Affected ≥ 6640b5df1a38801be6d0595c8cd2177d968d7ee0, < 15dd3429f0e76ca071657e480cb7e6ff3a1af730	Fixed in 15dd3429f0e76ca071657e480cb7e6ff3a1af730

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A fix has been implemented in the Linux kernel to address this infinite retry loop by adjusting the loop logic in init_vp_index(). Users should apply the official kernel updates that include this fix once available.

Description

A vulnerability in the Linux kernel's hv driver causes an infinite retry loop in the init_vp_index() function when certain CPU conditions related to housekeeping cpumasks and NUMA nodes occur. This issue arises if no CPU in a NUMA node is present in the housekeeping cpumask, leading to an infinite loop during initialization. The problem is rare but has been addressed by modifying the loop logic to skip NUMA nodes without housekeeping CPUs and improving early abort checks.

Impact

The vulnerability could cause the Linux kernel to enter an infinite retry loop during CPU initialization in the hv driver, potentially leading to system hang or denial of service conditions during boot or module initialization. There is no indication of code execution or privilege escalation from this flaw.

Summary

The Linux kernel hv driver contained a flaw in the init_vp_index() function where a retry loop could become infinite if the housekeeping cpumask (HK_TYPE_MANAGED_IRQ) did not contain any CPUs from a particular NUMA node. The loop logic stripped CPUs already allocated or not in the housekeeping cpumask, and if no CPUs remained, the process retried indefinitely. The fix involves skipping NUMA nodes lacking housekeeping CPUs in the inner loop and updating early abort conditions to check for online housekeeping CPUs, preventing the infinite retry scenario.

References

Community reviews

Loading reviews…