CVE-2026-99045
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: ibmveth: h_free logical LAN on open-fail after register ibmveth_open() registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to out_free_buffer_pools without h_free_logical_lan(), so PHYP still owns the buffer-list page when it is unmapped. request_irq() failure already issued the hypercall before taking the same label. Move that h_free to the shared post-register unwind so both paths deregister before the buffer list is unmapped.
Severity
Not scored
CVSS score
Not available
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-10-23 13:17:27.953000
Last modified
2026-10-30 13:21:41.573000
View original CVE JSON
{
"id": "CVE-2026-99045",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-10-23T13:17:27.953",
"lastModified": "2026-10-30T13:21:41.573",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nibmveth: h_free logical LAN on open-fail after register\n\nibmveth_open() registers the logical LAN, then allocates the RX\nbuffer pools. A pool failure jumps to out_free_buffer_pools without\nh_free_logical_lan(), so PHYP still owns the buffer-list page when\nit is unmapped. request_irq() failure already issued the hypercall\nbefore taking the same label.\n\nMove that h_free to the shared post-register unwind so both paths\nderegister before the buffer list is unmapped."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/net/ethernet/ibm/ibmveth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "d43732ce021f4244a4c53a45d57ad0c13c30ed94",
"lessThan": "073df7871a7023298ce27cfa518fbc30cc155651",
"versionType": "git",
"status": "affected"
},
{
"version": "d43732ce021f4244a4c53a45d57ad0c13c30ed94",
"lessThan": "7bd67d324d952101b3431c796d79f5e329bba159",
"versionType": "git",
"status": "affected"
},
{
"version": "d43732ce021f4244a4c53a45d57ad0c13c30ed94",
"lessThan": "eae138e880686ce19879aa0d158fa3c73516f632",
"versionType": "git",
"status": "affected"
},
{
"version": "d43732ce021f4244a4c53a45d57ad0c13c30ed94",
"lessThan": "decb4d4ead2c71ef698727734ab5024a872eb372",
"versionType": "git",
"status": "affected"
},
{
"version": "d43732ce021f4244a4c53a45d57ad0c13c30ed94",
"lessThan": "c54bbdf6f0731102a4bf7f5e4ee535b3ea415996",
"versionType": "git",
"status": "affected"
},
{
"version": "d43732ce021f4244a4c53a45d57ad0c13c30ed94",
"lessThan": "a065bd31ec462f6f9c267026b708dd020f122723",
"versionType": "git",
"status": "affected"
},
{
"version": "d43732ce021f4244a4c53a45d57ad0c13c30ed94",
"lessThan": "d24fdec1413c656d29298097926e77542785ca0c",
"versionType": "git",
"status": "affected"
},
{
"version": "d43732ce021f4244a4c53a45d57ad0c13c30ed94",
"lessThan": "af0524bf4ce1a4cbd2946aa81751582951cfcab5",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/net/ethernet/ibm/ibmveth.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "4.13",
"status": "affected"
},
{
"version": "0",
"lessThan": "4.13",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.273",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.224",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.191",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.160",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.113",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.57",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2.11",
"lessThanOrEqual": "7.2.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.3",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/073df7871a7023298ce27cfa518fbc30cc155651",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7bd67d324d952101b3431c796d79f5e329bba159",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a065bd31ec462f6f9c267026b708dd020f122723",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/af0524bf4ce1a4cbd2946aa81751582951cfcab5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c54bbdf6f0731102a4bf7f5e4ee535b3ea415996",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d24fdec1413c656d29298097926e77542785ca0c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/decb4d4ead2c71ef698727734ab5024a872eb372",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/eae138e880686ce19879aa0d158fa3c73516f632",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}