---
id: CVE-2026-99045
title: 'ibmveth: h_free logical LAN on open-fail after register'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ibmveth: h_free logical LAN on open-fail after register

  ibmveth_open() registers the logical LAN, then allocates the RX
  buffer pools. A pool failure jumps to out_free_…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d43732ce021f4244a4c53a45d57ad0c13c30ed94 <
    decb4d4ead2c71ef698727734ab5024a872eb372
  - >-
    Linux >= d43732ce021f4244a4c53a45d57ad0c13c30ed94 <
    c54bbdf6f0731102a4bf7f5e4ee535b3ea415996
  - >-
    Linux >= d43732ce021f4244a4c53a45d57ad0c13c30ed94 <
    a065bd31ec462f6f9c267026b708dd020f122723
  - >-
    Linux >= d43732ce021f4244a4c53a45d57ad0c13c30ed94 <
    d24fdec1413c656d29298097926e77542785ca0c
  - >-
    Linux >= d43732ce021f4244a4c53a45d57ad0c13c30ed94 <
    af0524bf4ce1a4cbd2946aa81751582951cfcab5
  - Linux 4.13
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:22:09.352Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99045'
references:
  - url: 'https://git.kernel.org/stable/c/decb4d4ead2c71ef698727734ab5024a872eb372'
  - url: 'https://git.kernel.org/stable/c/c54bbdf6f0731102a4bf7f5e4ee535b3ea415996'
  - url: 'https://git.kernel.org/stable/c/a065bd31ec462f6f9c267026b708dd020f122723'
  - url: 'https://git.kernel.org/stable/c/d24fdec1413c656d29298097926e77542785ca0c'
  - url: 'https://git.kernel.org/stable/c/af0524bf4ce1a4cbd2946aa81751582951cfcab5'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.527Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ibmveth: h_free logical LAN on open-fail after register

ibmveth_open() registers the logical LAN, then allocates the RX
buffer pools. A pool failure jumps to out_free_buffer_pools without
h_free_logical_lan(), so PHYP still owns the buffer-list page when
it is unmapped. request_irq() failure already issued the hypercall
before taking the same label.

Move that h_free to the shared post-register unwind so both paths
deregister before the buffer list is unmapped.

## Affected

- `Linux >= d43732ce021f4244a4c53a45d57ad0c13c30ed94 < decb4d4ead2c71ef698727734ab5024a872eb372`
- `Linux >= d43732ce021f4244a4c53a45d57ad0c13c30ed94 < c54bbdf6f0731102a4bf7f5e4ee535b3ea415996`
- `Linux >= d43732ce021f4244a4c53a45d57ad0c13c30ed94 < a065bd31ec462f6f9c267026b708dd020f122723`
- `Linux >= d43732ce021f4244a4c53a45d57ad0c13c30ed94 < d24fdec1413c656d29298097926e77542785ca0c`
- `Linux >= d43732ce021f4244a4c53a45d57ad0c13c30ed94 < af0524bf4ce1a4cbd2946aa81751582951cfcab5`
- `Linux 4.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.