CVE-2026-99045: ibmveth: h_free logical LAN on open-fail after register

Published Oct 23, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

ibmveth: hfree logical LAN on open-fail after register

ibmvethopen() registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to outfreebufferpools without hfreelogicallan(), so PHYP still owns the buffer-list page when it is unmapped. requestirq() failure already issued the hypercall before taking the same label.

Move that hfree to the shared post-register unwind so both paths deregister before the buffer list is unmapped.

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 23, 2026

CVE Published

via MITRE·12:22 PM

Data Sourced

via MITRE·12:22 PM

Description

Frequently Asked Questions

When is a system exposed to this failure path?

The issue occurs when ibmveth has registered the logical LAN and then RX buffer-pool allocation fails. The request_irq() failure path is also relevant because it has already issued the registration hypercall before cleanup begins.

What cleanup must occur to prevent the stale hypervisor ownership?

The logical LAN must be deregistered with h_free_logical_lan() before the buffer-list page is unmapped. The resolved code moves this cleanup into the shared post-registration unwind path so it runs for both RX pool allocation and request_irq() failures.

CVE-2026-99045: ibmveth: h_free logical LAN on open-fail after register

Affected Software

Event History

Frequently Asked Questions

When is a system exposed to this failure path?

What cleanup must occur to prevent the stale hypervisor ownership?

Company

Resources

Contact

Frequently Asked Questions

When is a system exposed to this failure path?

What cleanup must occur to prevent the stale hypervisor ownership?