In the Linux kernel, the following vulnerability has been resolved: ibmveth: h_free logical LAN on open-fail after register ibmveth_open() registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to out_free_buffer_pools without h_free_logical_lan(), so PHYP still owns the buffer-list page when it is unmapped. request_irq() failure already issued the hypercall before taking the same label. Move that h_free to the shared post-register unwind so both paths deregister before the buffer list is unmapped.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 3
- StatusReceived → PublishedNVD modified 2026-10-23 12:22
- StatusPublished → ReceivedNVD modified 2026-10-23 13:17
- First seenunscored · linuxNVD modified 2026-10-23 12:22
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 5
- https://git.kernel.org/stable/c/a065bd31ec462f6f9c267026b708dd020f122723
- https://git.kernel.org/stable/c/af0524bf4ce1a4cbd2946aa81751582951cfcab5
- https://git.kernel.org/stable/c/c54bbdf6f0731102a4bf7f5e4ee535b3ea415996
- https://git.kernel.org/stable/c/d24fdec1413c656d29298097926e77542785ca0c
- https://git.kernel.org/stable/c/decb4d4ead2c71ef698727734ab5024a872eb372