In the Linux kernel, the following vulnerability has been resolved: ibmveth: h_free logical LAN on open-fail after register ibmveth_open() registers… (CVE-2026-99045)

The vulnerability in the Linux kernel ibmveth driver occurs because ibmveth_open() registers the logical LAN before allocating RX buffer pools. If allocation fails, the error path jumps to out_free_buffer_pools without calling h_free_logical_lan(), causing PHYP to retain ownership of the buffer-list page during unmapping. Additionally, request_irq() failure already issues the hypercall before taking the same label. The patch moves the h_free call to a common post-register unwind path so that both error paths properly deregister the logical LAN before unmapping the buffer list, preventing resource mismanagement.

The vulnerability results in improper resource cleanup on failure paths during the ibmveth logical LAN open operation, potentially causing resource leaks or inconsistent state in the hypervisor (PHYP) buffer ownership. There is no indication of direct code execution or privilege escalation. No known exploits are reported in the wild.

A fix has been implemented in the Linux kernel to move the h_free_logical_lan() call to a shared post-register unwind path, ensuring proper deregistration on all failure paths. Users should update to the fixed kernel version once available. Patch status is not explicitly confirmed; check the vendor advisory for current remediation guidance.