Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-99045EUVD-2026-108840GHSA-5HCH-2JPC-2MCV

ibmveth: h_free logical LAN on open-fail after register

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 6.6.160, 6.12.113, 6.18.57, 7.2.11
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: ibmveth: h_free logical LAN on open-fail after register ibmveth_open() registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to out_free_buffer_pools without h_free_logical_lan(), so PHYP still owns the buffer-list page when it is unmapped. request_irq() failure already issued the hypercall before taking the same label. Move that h_free to the shared post-register unwind so both paths deregister before the buffer list is unmapped.

Timeline

  1. CVE published
  2. First seen by cve.now
  3. Record last updated

Affected versions

  • Linux Linux

    Version range not reported

  • Linux Linux

    4.13

  • KernelLinux

    From 4.13.0 · fixed in 6.6.160; From 6.7.0 · fixed in 6.12.113; From 6.13.0 · fixed in 6.18.57; From 6.19.0 · fixed in 7.2.11

References 8

git.kernel.org