Live › vulnerability › CVE-2026-99045
Go to dashboardThe ibmveth virtual Ethernet driver on IBM Power systems skips releasing its logical LAN registration with the hypervisor when opening the device fails after buffer pool allocation. The hypervisor keeps ownership of a buffer-list page that the kernel then unmaps, so the failure path leaves hypervisor and kernel state inconsistent.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only Linux systems running on IBM Power hardware or LPARs that use the ibmveth virtual Ethernet driver are relevant. Systems on x86, ARM, or other platforms without this driver can skip it. The sources do not describe an attacker-triggerable path or a confirmed security impact.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
ibmveth: h_free logical LAN on open-fail after register
ibmveth_open() registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to out_free_buffer_pools without h_free_logical_lan(), so PHYP still owns the buffer-list page when it is unmapped. request_irq() failure already issued the hypercall before taking the same label.
Move that h_free to the shared post-register unwind so both paths deregister before the buffer list is unmapped.
This page as .md · .json · in your agent: get_signal("CVE-2026-99045")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.