CVE-2026-72042 (GCVE-0-2026-72042)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:52 – Updated: 2026-08-17 05:39
VLAI
Title
ipmi: Fix user refcount underflow in event delivery
Summary
In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix user refcount underflow in event delivery ipmi_alloc_recv_msg(user) takes the temporary user reference owned by the receive message, and ipmi_free_recv_msg() drops it again. If event delivery fails after allocating receive messages for earlier users, handle_read_event_rsp() rolls those messages back with ipmi_free_recv_msg(). That rollback path still drops user->refcount explicitly after freeing each message. The extra put can free a user that remains linked on intf->users, so later event delivery may dereference a freed user or trip refcount_t's addition-on-zero warning when ipmi_alloc_recv_msg() tries to acquire another reference. Remove the stale explicit put and the now-dead user assignment. Keep the list_del() and ipmi_free_recv_msg() calls; they are the required rollback operations.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b52da4054ee0bf9ecb44996f2c83236ff50b3812 , < ddbb6e3dc9bb4743de686aa1598c31e745cee76b (git)
Affected: b52da4054ee0bf9ecb44996f2c83236ff50b3812 , < 7be349d4fcc5e065295b83418a22d27a68afbdb6 (git)
Affected: b52da4054ee0bf9ecb44996f2c83236ff50b3812 , < 6aa9e61c46465d231e9beddf56af7effd71be682 (git)
Affected: f63723ca7d7623f9dae1990973cd158671f03c56 (git)
Affected: 348121b29594d42d1635648fd3ed31dfa25351d5 (git)
Affected: 53d6e403affbf6df2c859a0ea00ccfc1e72090ca (git)
Affected: 0ed73be9a2547ffb9b5c1d879ad9bfab73d920b5 (git)
Affected: 6.1.157 , < 6.2 (semver)
Affected: 6.6.113 , < 6.7 (semver)
Affected: 6.12.54 , < 6.13 (semver)
Affected: 6.17.4 , < 6.18 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/char/ipmi/ipmi_msghandler.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ddbb6e3dc9bb4743de686aa1598c31e745cee76b",
              "status": "affected",
              "version": "b52da4054ee0bf9ecb44996f2c83236ff50b3812",
              "versionType": "git"
            },
            {
              "lessThan": "7be349d4fcc5e065295b83418a22d27a68afbdb6",
              "status": "affected",
              "version": "b52da4054ee0bf9ecb44996f2c83236ff50b3812",
              "versionType": "git"
            },
            {
              "lessThan": "6aa9e61c46465d231e9beddf56af7effd71be682",
              "status": "affected",
              "version": "b52da4054ee0bf9ecb44996f2c83236ff50b3812",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f63723ca7d7623f9dae1990973cd158671f03c56",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "348121b29594d42d1635648fd3ed31dfa25351d5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "53d6e403affbf6df2c859a0ea00ccfc1e72090ca",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0ed73be9a2547ffb9b5c1d879ad9bfab73d920b5",
              "versionType": "git"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.157",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.113",
              "versionType": "semver"
            },
            {
              "lessThan": "6.13",
              "status": "affected",
              "version": "6.12.54",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18",
              "status": "affected",
              "version": "6.17.4",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/char/ipmi/ipmi_msghandler.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.157",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.113",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.12.54",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.17.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmi: Fix user refcount underflow in event delivery\n\nipmi_alloc_recv_msg(user) takes the temporary user reference owned by the\nreceive message, and ipmi_free_recv_msg() drops it again. If event delivery\nfails after allocating receive messages for earlier users,\nhandle_read_event_rsp() rolls those messages back with\nipmi_free_recv_msg().\n\nThat rollback path still drops user-\u003erefcount explicitly after freeing each\nmessage. The extra put can free a user that remains linked on intf-\u003eusers,\nso later event delivery may dereference a freed user or trip refcount_t\u0027s\naddition-on-zero warning when ipmi_alloc_recv_msg() tries to acquire\nanother reference.\n\nRemove the stale explicit put and the now-dead user assignment. Keep the\nlist_del() and ipmi_free_recv_msg() calls; they are the required rollback\noperations."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local setup via /dev/ipmiN (open, IPMICTL_SET_GETS_EVENTS, message flooding); the refcount bug is in handle_read_event_rsp() during host-side BMC event processing, not via a remote packet path to the kernel.\nAC:L - An attacker with IPMI device access controls both sides: multiple fds, gets_events registration, filling one user\u0027s outstanding-message limit to force EBUSY, and generating/waiting for BMC events via their own IPMI commands.\nPR:L - ipmi_open/ipmi_create_user perform no capability() check; access is gated only by /dev/ipmiN DAC, and BMC-equipped servers often grant that node to a non-root management group (ipmi) for ipmitool/freeipmi.\nUI:N - No victim interaction is required; the attacker drives all setup and triggering through their own IPMI file descriptors and ioctls.\nS:U - This is a host-kernel heap use-after-free of struct ipmi_user within the same OS security authority, with no VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - Premature free_ipmi_user() leaves a dangling ipmi_user on intf-\u003eusers; later iterations call kref_get and read handler pointers from freed slab memory, yielding arbitrary kernel read primitives per UAF guidance.\nI:H - Freed ipmi_user objects contain function pointers (handler-\u003eipmi_recv_hndl); smi_work later invokes these on reclaimed memory, enabling heap spray and control-flow hijack for arbitrary kernel write/code execution.\nA:H - The extra kref_put causes refcount underflow warnings and use-after-free of ipmi_user; subsequent event delivery dereferences freed memory and readily triggers kernel oops/panic under KASAN/poisoning."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:39:41.572Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ddbb6e3dc9bb4743de686aa1598c31e745cee76b"
        },
        {
          "url": "https://git.kernel.org/stable/c/7be349d4fcc5e065295b83418a22d27a68afbdb6"
        },
        {
          "url": "https://git.kernel.org/stable/c/6aa9e61c46465d231e9beddf56af7effd71be682"
        }
      ],
      "title": "ipmi: Fix user refcount underflow in event delivery",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72042",
    "datePublished": "2026-08-15T05:52:01.454Z",
    "dateReserved": "2026-08-09T03:40:39.902Z",
    "dateUpdated": "2026-08-17T05:39:41.572Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72042",
      "date": "2026-09-20",
      "epss": "0.00162",
      "percentile": "0.058"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-23T14:56:40.000Z",
      "cve": "CVE-2026-72042",
      "id": "msrc_CVE-2026-72042",
      "initial_release_date": "2026-08-23T14:56:40.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ipmi: Fix user refcount underflow in event delivery",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-72042.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/char/ipmi/ipmi_msghandler.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ddbb6e3dc9bb4743de686aa1598c31e745cee76b",
                    "status": "affected",
                    "version": "b52da4054ee0bf9ecb44996f2c83236ff50b3812",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7be349d4fcc5e065295b83418a22d27a68afbdb6",
                    "status": "affected",
                    "version": "b52da4054ee0bf9ecb44996f2c83236ff50b3812",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6aa9e61c46465d231e9beddf56af7effd71be682",
                    "status": "affected",
                    "version": "b52da4054ee0bf9ecb44996f2c83236ff50b3812",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "f63723ca7d7623f9dae1990973cd158671f03c56",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "348121b29594d42d1635648fd3ed31dfa25351d5",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "53d6e403affbf6df2c859a0ea00ccfc1e72090ca",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "0ed73be9a2547ffb9b5c1d879ad9bfab73d920b5",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.2",
                    "status": "affected",
                    "version": "6.1.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.7",
                    "status": "affected",
                    "version": "6.6.113",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.13",
                    "status": "affected",
                    "version": "6.12.54",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.18",
                    "status": "affected",
                    "version": "6.17.4",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/char/ipmi/ipmi_msghandler.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.18"
                  },
                  {
                    "lessThan": "6.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmi: Fix user refcount underflow in event delivery\n\nipmi_alloc_recv_msg(user) takes the temporary user reference owned by the\nreceive message, and ipmi_free_recv_msg() drops it again. If event delivery\nfails after allocating receive messages for earlier users,\nhandle_read_event_rsp() rolls those messages back with\nipmi_free_recv_msg().\n\nThat rollback path still drops user-\u003erefcount explicitly after freeing each\nmessage. The extra put can free a user that remains linked on intf-\u003eusers,\nso later event delivery may dereference a freed user or trip refcount_t\u0027s\naddition-on-zero warning when ipmi_alloc_recv_msg() tries to acquire\nanother reference.\n\nRemove the stale explicit put and the now-dead user assignment. Keep the\nlist_del() and ipmi_free_recv_msg() calls; they are the required rollback\noperations."
          }
        ],
        "id": "CVE-2026-72042",
        "lastModified": "2026-08-17T06:18:02.133",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:21:13.370",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6aa9e61c46465d231e9beddf56af7effd71be682"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7be349d4fcc5e065295b83418a22d27a68afbdb6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ddbb6e3dc9bb4743de686aa1598c31e745cee76b"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-12T10:59:50+00:00",
      "cve": "CVE-2026-72042",
      "id": "CVE-2026-72042",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ipmi: Fix user refcount underflow in event delivery",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72042.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-27T16:53:47Z",
      "cve": "CVE-2026-72042",
      "id": "CVE-2026-72042",
      "initial_release_date": "2026-08-27T16:53:47Z",
      "product_status:known_not_affected": "290",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72042",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72042.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.