All vulnerabilities
CVE-2026-99045

Linux: ibmveth: h_free logical LAN on open-fail after register

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version yet
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

In the Linux kernel, the following vulnerability has been resolved:

ibmveth: h_free logical LAN on open-fail after register

ibmveth_open() registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to out_free_buffer_pools without h_free_logical_lan(), so PHYP still owns the buffer-list page when it is unmapped. request_irq() failure already issued the hypercall before taking the same label.

Move that h_free to the shared post-register unwind so both paths deregister before the buffer list is unmapped.

Text from CVE List

Affected versions 12

  • Linuxaffected: d43732ce021f4244a4c53a45d57ad0c13c30ed94 before decb4d4ead2c71ef698727734ab5024a872eb372CVE List
  • Linuxaffected: d43732ce021f4244a4c53a45d57ad0c13c30ed94 before c54bbdf6f0731102a4bf7f5e4ee535b3ea415996CVE List
  • Linuxaffected: d43732ce021f4244a4c53a45d57ad0c13c30ed94 before a065bd31ec462f6f9c267026b708dd020f122723CVE List
  • Linuxaffected: d43732ce021f4244a4c53a45d57ad0c13c30ed94 before d24fdec1413c656d29298097926e77542785ca0cCVE List
  • Linuxaffected: d43732ce021f4244a4c53a45d57ad0c13c30ed94 before af0524bf4ce1a4cbd2946aa81751582951cfcab5CVE List
  • Linuxaffected: 4.13CVE List
  • Linuxunaffected: all versions before 4.13CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.11 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5