{"id":"CVE-2026-99045","kind":"vulnerability","aliases":["CVE-2026-99045"],"related":[],"title":"Linux kernel: ibmveth driver leaks hypervisor buffer on failed open","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nibmveth: h_free logical LAN on open-fail after register\n\nibmveth_open() registers the logical LAN, then allocates the RX\nbuffer pools. A pool failure jumps to out_free_buffer_pools without\nh_free_logical_lan(), so PHYP still owns the buffer-list page when\nit is unmapped. request_irq() failure already issued the hypercall\nbefore taking the same label.\n\nMove that h_free to the shared post-register unwind so both paths\nderegister before the buffer list is unmapped.","summary":"The ibmveth virtual Ethernet driver on IBM Power systems skips releasing its logical LAN registration with the hypervisor when opening the device fails after buffer pool allocation. The hypervisor keeps ownership of a buffer-list page that the kernel then unmaps, so the failure path leaves hypervisor and kernel state inconsistent.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-power","ibmveth","infrastructure","linux-kernel"],"not_affected_if":["ibmveth-not-loaded","non-power-hardware"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-23T13:17:27+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:54:09+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T04:54:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: ibmveth driver leaks hypervisor buffer on failed open","impact":"low","summary":"The ibmveth virtual Ethernet driver on IBM Power systems skips releasing its logical LAN registration with the hypervisor when opening the device fails after buffer pool allocation. The hypervisor keeps ownership of a buffer-list page that the kernel then unmaps, so the failure path leaves hypervisor and kernel state inconsistent.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","ibm-power","ibmveth"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; the sources describe a resource ownership bug, not code execution","analyst_note":"Check the upstream kernel commit and NVD entry for CVSS and fixed kernel versions, and confirm whether any exploit path reaches an attacker.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["non-power-hardware","ibmveth-not-loaded"],"who_is_affected":"Only Linux systems running on IBM Power hardware or LPARs that use the ibmveth virtual Ethernet driver are relevant. Systems on x86, ARM, or other platforms without this driver can skip it. The sources do not describe an attacker-triggerable path or a confirmed security impact.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000603,"input_tokens":3407,"output_tokens":525,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-99045':13A,16A 'alloc':51B,105C 'alreadi':140C 'buffer':7A,49B,59B,108C,117C,130C,166C 'buffer-list':58B,129C 'cve':11A,14A 'deregist':163C 'devic':46B 'driver':4A,29B 'ethernet':28B 'fail':9A,47B,95C 'failur':69B,112C,139C 'follow':82C 'free':89C,116C,121C,152C 'h':88C,120C,151C 'hypercal':143C 'hypervisor':6A,42B,53B,72B 'ibm':18B,31B 'ibm-pow':17B 'ibmveth':3A,20B,26B,87C,98C 'inconsist':76B 'infrastructur':21B 'irq':138C 'issu':141C 'jump':113C 'keep':54B 'kernel':2A,24B,64B,74B,80C 'label':148C 'lan':38B,91C,103C,123C 'leak':5A 'leav':71B 'linux':1A,23B,79C 'linux-kernel':22B 'list':60B,131C,167C 'logic':37B,90C,102C,122C 'move':149C 'open':10A,44B,94C,99C 'open-fail':93C 'own':127C 'ownership':55B 'page':61B,132C 'path':70B,162C 'phyp':125C 'pool':50B,109C,111C,118C 'post':157C 'post-regist':156C 'power':19B,32B 'regist':97C,100C,158C 'registr':39B 'releas':35B 'request':137C 'resolv':86C 'rx':107C 'share':155C 'skip':34B 'state':75B 'still':126C 'system':33B 'take':145C 'unmap':66B,136C,169C 'unwind':159C 'virtual':27B 'vulner':83C 'without':119C","nicknames":[],"mitigations":[],"who_affected":"Only Linux systems running on IBM Power hardware or LPARs that use the ibmveth virtual Ethernet driver are relevant. Systems on x86, ARM, or other platforms without this driver can skip it. The sources do not describe an attacker-triggerable path or a confirmed security impact.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99045","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99045","severity":null,"published_at":"2026-10-23T13:17:27+00:00","modified_at":"2026-10-23T13:17:27+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-99045","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99045","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}