PT-2026-122022
CVE-2026-99045
·
Published
2026-10-23
·
Updated
2026-10-23
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
ibmveth: h free logical LAN on open-fail after register
ibmveth open() registers the logical LAN, then allocates the RX
buffer pools. A pool failure jumps to out free buffer pools without
h free logical lan(), so PHYP still owns the buffer-list page when
it is unmapped. request irq() failure already issued the hypercall
before taking the same label.
Move that h free to the shared post-register unwind so both paths
deregister before the buffer list is unmapped.
Found an issue in the description? Have something to add? Feel free to write us 👾