Answer in brief
CVE-2026-99045 records a Unknown severity vulnerability in ibmveth: h_free logical LAN on open-fail after register. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=d43732ce021f4244a4c53a45d57ad0c13c30ed94 <decb4d4ead2c71ef698727734ab5024a872eb372 || >=d43732ce021f4244a4c53a45d57ad0c13c30ed94 <c54bbdf6f0731102a4bf7f5e4ee535b3ea415996 || >=d43732ce021f4244a4c53a45d57ad0c13c30ed94 <a065bd31ec462f6f9c267026b708dd020f122723 || >=d43732ce021f4244a4c53a45d57ad0c13c30ed94 <d24fdec1413c656d29298097926e77542785ca0c || >=d43732ce021f4244a4c53a45d57ad0c13c30ed94 <af0524bf4ce1a4cbd2946aa81751582951cfcab5 | decb4d4ead2c71ef698727734ab5024a872eb372, c54bbdf6f0731102a4bf7f5e4ee535b3ea415996, a065bd31ec462f6f9c267026b708dd020f122723, d24fdec1413c656d29298097926e77542785ca0c, af0524bf4ce1a4cbd2946aa81751582951cfcab5 |
| Linux/Linuxgeneric | 4.13 | Not reported |
Published upstream
Oct 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 23, 2026
In the Linux kernel, the following vulnerability has been resolved: ibmveth: h_free logical LAN on open-fail after register ibmveth_open() registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to out_free_buffer_pools without h_free_logical_lan(), so PHYP still owns the buffer-list page when it is unmapped. request_irq() failure already issued the hypercall before taking the same label. Move that h_free to the shared post-register unwind so both paths deregister before the buffer list is unmapped.
Quoted source text, attributed separately from HOL analysis.