Cloudanix VulnDB

CVE-2026-99045

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

An error-handling mistake in a network driver on certain IBM hardware could allow a local problem to crash the system or let an attacker gain more control than intended.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing h_free_logical_lan() call on error paths after logical LAN registration in ibmveth_open leaves a buffer-list page owned by PHYP when unmapped, resulting in use-after-free.

Why it matters to the business

Potential kernel instability, crashes, or privilege escalation on IBM POWER virtualized systems using the ibmveth driver, increasing operational risk in affected environments.

How an attack unfolds

An attacker with local access triggers an RX buffer pool allocation failure or request_irq failure after logical LAN registration to exploit the dangling PHYP reference during unmap.

How to fix it

Apply the upstream kernel fix that moves h_free_logical_lan to the shared post-register unwind path; rebuild and deploy updated kernel images.

How to confirm the fix worked

Inspect ibmveth_open source to confirm h_free_logical_lan is called before buffer list unmap on all error paths; test open-failure scenarios in a lab environment.

Typical attack path

  1. Obtain local access on affected system
  2. Invoke ibmveth_open error path via resource exhaustion or IRQ failure
  3. Trigger use-after-free during buffer list unmap

How to detect it

Search kernel logs and crash dumps for ibmveth-related use-after-free signatures or oops involving logical LAN registration and buffer unmap operations.

What your security team should do

  • Prioritize kernel updates on IBM POWER systems within standard patching windows
  • Review ibmveth usage in virtualized deployments for exposure
  • Monitor kernel logs for related oops or warnings

The record

In the Linux kernel, the following vulnerability has been resolved: ibmveth: h_free logical LAN on open-fail after register ibmveth_open() registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to out_free_buffer_pools without h_free_logical_lan(), so PHYP still owns the buffer-list page when it is unmapped. request_irq() failure already issued the hypercall before taking the same label. Move that h_free to the shared post-register unwind so both paths deregister before the buffer list is unmapped.

Affected packages

Ecosystem Package Introduced Fixed