Infinite retry loop in Linux kernel Hyper-V init_vp_index()
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from CNA.
Summary
In the Linux kernel from 5.19, the Hyper-V driver function init_vp_index() can enter an infinite retry loop when a NUMA node has no housekeeping CPU for managed IRQs. The loop never ends because the node's CPUs are stripped out on each retry and the outer check does not catch the empty case.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Avoid infinite retry loop in init_vp_index() There is a retry loop in init_vp_index() where the CPUs from a certain node are stripped out if they have already been in the allocated cpumask or not in HK_TYPE_MANAGED_IRQ housekeeping cpumask. If there is no CPU left, the allocated cpumask is ignored and the process is retried again. However, if the HK_TYPE_MANAGED_IRQ housekeeping cpumask turns out not to contain any CPU in that particular node, that will become an infinite retry loop. This particular problem was reported by sashiko [1]. This should rarely happen, but we still need to guard against this. Fix this infinite loop problem by also skipping NUMA node that has no housekeeping CPU in the inner while loop of init_vp_index(). Also update the early abort check to check for the absence of online housekeeping CPUs instead of just the emptiness of the cpumask. As the outer for loop will only be reached if the housekeeping cpumask has at least one online CPU, a NUMA node with housekeeping CPUs will eventually be found.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
Update the Linux kernel to 6.1.191, 6.6.161, 6.12.115, 6.18.59, 7.2.13 or 7.3, whichever matches the installed release branch.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA Linux (Linux) Fixed in 6.1.191, 6.6.161, 6.12.115, 6.18.59, 7.2.13, 7.3
Timeline
- 2026-11-03 Threatist record created from CVE-2026-99251
- 2026-11-03 Alias added: GHSA-pccv-95f7-7fv3
References
Other 6
- https://git.kernel.org/stable/c/b3993f6dc106ff416c7a613c631e1e0af451aed7
- https://git.kernel.org/stable/c/f561392afb44a8a42c54c1cfd3f33dace0b50537
- https://git.kernel.org/stable/c/15dd3429f0e76ca071657e480cb7e6ff3a1af730
- https://git.kernel.org/stable/c/7141331f2d245efc07175802a6bf76badec871ed
- https://git.kernel.org/stable/c/95fec47cdbf747b81ab22affd7252dda6050ad0c
- https://git.kernel.org/stable/c/32ea0a33e3a0fb7c10c601b43e1b2f6c06a3f5fd
More Linux vulnerabilities
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
- TI-2021-02452 Incorrect authorization in Ubuntu linux kernel KEVCVSS 3.1HIGH 8.8
- TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
- TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
- TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
Sources
- CVE-2026-99251 · CVE Program
- CVE-2026-99251 · NVD
- FIRST EPSS
- GHSA-pccv-95f7-7fv3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences