CVE-2026-99045

Not scored yetLast modified Oct 23, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ibmveth: h_free logical LAN on open-fail after register

ibmveth_open() registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to out_free_buffer_pools without h_free_logical_lan(), so PHYP still owns the buffer-list page when it is unmapped. request_irq() failure already issued the hypercall before taking the same label.

Move that h_free to the shared post-register unwind so both paths deregister before the buffer list is unmapped.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 23, 2026
Last modified
Oct 23, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-990467.5In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is setCVE-2026-99047In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak when rings are stopped GVE does not free XSK CVE-2026-99048In the Linux kernel, the following vulnerability has been resolved: gve: fix napi_disable deadlock when attempting to disable XSK pools WhCVE-2026-99049In the Linux kernel, the following vulnerability has been resolved: gpio: xilinx: fix runtime PM leak on request error path pm_runtime_getCVE-2026-99058.3Use after free in Accessibility in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderCVE-2026-990507.8In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: fix race when arming the IRQ poll worker gpio_mpsse_irq_eCVE-2026-990517.8In the Linux kernel, the following vulnerability has been resolved: fsverity: RCU-delay the freeing of struct fsverity_info __fsverity_getCVE-2026-99052In the Linux kernel, the following vulnerability has been resolved: selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opCVE-2026-990537.8In the Linux kernel, the following vulnerability has been resolved: tipc: hold a reference to nodes found by link name tipc_node_find_by_nCVE-2026-990547.8In the Linux kernel, the following vulnerability has been resolved: tipc: destroy topsrv workqueues before closing connections tipc_topsrvCVE-2026-99055In the Linux kernel, the following vulnerability has been resolved: tcp: reject net_iov in zerocopy receive mapping hints After copying a CVE-2026-990567.8In the Linux kernel, the following vulnerability has been resolved: strparser: make sure __strp_recv isn't running before tearing down the
CVE-2026-99045: Unscored | Vulnix