---
id: "CVE-2026-99045"
kind: "vulnerability"
aliases: ["CVE-2026-99045"]
title: "Linux kernel: ibmveth driver leaks hypervisor buffer on failed open"
severity: "unknown"
cvss: null
epss: 0.00209
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["ibm-power", "ibmveth", "infrastructure", "linux-kernel"]
not_affected_if: ["ibmveth-not-loaded", "non-power-hardware"]
published_at: "2026-10-23T13:17:27+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99045", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-99045", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Linux kernel: ibmveth driver leaks hypervisor buffer on failed open

The ibmveth virtual Ethernet driver on IBM Power systems skips releasing its logical LAN registration with the hypervisor when opening the device fails after buffer pool allocation. The hypervisor keeps ownership of a buffer-list page that the kernel then unmaps, so the failure path leaves hypervisor and kernel state inconsistent.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99045
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-99045

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

ibmveth: h_free logical LAN on open-fail after register

ibmveth_open() registers the logical LAN, then allocates the RX
buffer pools. A pool failure jumps to out_free_buffer_pools without
h_free_logical_lan(), so PHYP still owns the buffer-list page when
it is unmapped. request_irq() failure already issued the hypercall
before taking the same label.

Move that h_free to the shared post-register unwind so both paths
deregister before the buffer list is unmapped.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_