CVE-2026-99045
ibmveth: h_free logical LAN on open-fail after register
Fetching some sources has been requested. Reload in about a minute to see them.
CVSS v3.1 (listed by NVD)
—
Not scored
CVSS v4.0 (listed by NVD)
—
Not scored
CVSS (listed by CVE.org)
—
Not scored
EPSS exploit probability
0.2%
Percentile 10.5%
as of 2026-10-24
CISA KEV
—
Not listed
Description
NVD
In the Linux kernel, the following vulnerability has been resolved: ibmveth: h_free logical LAN on open-fail after register ibmveth_open() registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to out_free_buffer_pools without h_free_logical_lan(), so PHYP still owns the buffer-list page when it is unmapped. request_irq() failure already issued the hypercall before taking the same label. Move that h_free to the shared post-register unwind so both paths deregister before the buffer list is unmapped.
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | affected: d43732ce021f4244a4c53a45d57ad0c13c30ed94 … < decb4d4ead2c71ef698727734ab5024a872eb372 affected: d43732ce021f4244a4c53a45d57ad0c13c30ed94 … < c54bbdf6f0731102a4bf7f5e4ee535b3ea415996 affected: d43732ce021f4244a4c53a45d57ad0c13c30ed94 … < a065bd31ec462f6f9c267026b708dd020f122723 affected: d43732ce021f4244a4c53a45d57ad0c13c30ed94 … < d24fdec1413c656d29298097926e77542785ca0c affected: d43732ce021f4244a4c53a45d57ad0c13c30ed94 … < af0524bf4ce1a4cbd2946aa81751582951cfcab5 default: unaffected |
| Linux | Linux | affected: 4.13 unaffected: 0 … < 4.13 unaffected: 6.6.160 … <= 6.6.* unaffected: 6.12.113 … <= 6.12.* unaffected: 6.18.57 … <= 6.18.* unaffected: 7.2.11 … <= 7.2.* unaffected: 7.3 … <= * default: affected |
Open-source packages (GitHub Advisory / OSV)
CVE-2026-99045
OSV
ibmveth: h_free logical LAN on open-fail after register
| Ecosystem | Package | Affected versions | Fixed in |
|---|---|---|---|
| >= d43732ce021f4244a4c53a45d57ad0c13c30ed94, < decb4d4ead2c71ef698727734ab5024a872eb372; < c54bbdf6f0731102a4bf7f5e4ee535b3ea415996; < a065bd31ec462f6f9c267026b708dd020f122723; < d24fdec1413c656d29298097926e77542785ca0c; < af0524bf4ce1a4cbd2946aa81751582951cfcab5 | decb4d4ead2c71ef698727734ab5024a872eb372, c54bbdf6f0731102a4bf7f5e4ee535b3ea415996, a065bd31ec462f6f9c267026b708dd020f122723, d24fdec1413c656d29298097926e77542785ca0c, af0524bf4ce1a4cbd2946aa81751582951cfcab5 | ||
| Linux | Kernel | >= 4.13.0, < 6.6.160; >= 6.7.0, < 6.12.113; >= 6.13.0, < 6.18.57; >= 6.19.0, < 7.2.11 | 6.6.160, 6.12.113, 6.18.57, 7.2.11 |
Linux distribution status
References (8)
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git OSV
- https://git.kernel.org/stable/c/a065bd31ec462f6f9c267026b708dd020f122723 NVD, CNA, OSV
- https://git.kernel.org/stable/c/af0524bf4ce1a4cbd2946aa81751582951cfcab5 NVD, CNA, OSV
- https://git.kernel.org/stable/c/c54bbdf6f0731102a4bf7f5e4ee535b3ea415996 NVD, CNA, OSV
- https://git.kernel.org/stable/c/d24fdec1413c656d29298097926e77542785ca0c NVD, CNA, OSV
- https://git.kernel.org/stable/c/decb4d4ead2c71ef698727734ab5024a872eb372 NVD, CNA, OSV
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/99xxx/CVE-2026-99045.json OSV
- https://nvd.nist.gov/vuln/detail/CVE-2026-99045 OSV