CVE-2026-99045
Published Oct 23, 2026
Description
In the Linux kernel, the following vulnerability has been resolved: ibmveth: h_free logical LAN on open-fail after register ibmveth_open() registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to out_free_buffer_pools without h_free_logical_lan(), so PHYP still owns the buffer-list page when it is unmapped. request_irq() failure already issued the hypercall before taking the same label. Move that h_free to the shared post-register unwind so both paths deregister before the buffer list is unmapped.
Is your site exposed to CVE-2026-99045?
Run a free security scan — no signup, results in seconds.
References
Other References
https://git.kernel.org/stable/c/a065bd31ec462f6f9c267026b708dd020f122723
https://git.kernel.org/stable/c/af0524bf4ce1a4cbd2946aa81751582951cfcab5
https://git.kernel.org/stable/c/c54bbdf6f0731102a4bf7f5e4ee535b3ea415996
https://git.kernel.org/stable/c/d24fdec1413c656d29298097926e77542785ca0c
https://git.kernel.org/stable/c/decb4d4ead2c71ef698727734ab5024a872eb372
Frequently Asked Questions
What is CVE-2026-99045? +
In the Linux kernel, the following vulnerability has been resolved:
ibmveth: h_free logical LAN on open-fail after register
ibmveth_open() registers the logical LAN, then allocates the RX
buffer pools. A pool failure jumps to out_free_buffer_pools without
h_free_logical_lan(), so PHYP still owns the buffer-list page when
it is unmapped. request_irq() failure already issued the hypercall
before taking the same label.
Move that h_free to the shared post-register unwind so both paths
deregister before the buffer list is unmapped.
How do I check if I'm vulnerable to CVE-2026-99045? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.