CVE-2026-99045

In the Linux kernel, the following vulnerability has been resolved:

ibmveth: h free logical LAN on open-fail after register

ibmveth open() registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to out free buffer pools without h free logical lan(), so PHYP still owns the buffer-list page when it is unmapped. request irq() failure already issued the hypercall before taking the same label.

Move that h free to the shared post-register unwind so both paths deregister before the buffer list is unmapped.