HIGH
ipmi SmiWork UAF
CVE-2026-81004
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.3MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: ipmi:msghandler: Cancel work cleanly on an error If an error occurs during startup of an IPMI interface, it may have scheduled work to run. The work needs to be canceled before the interface can be freed.
02KernelScan AI Analysis
Risk summary
A use-after-free in the IPMI message handler occurs when an error during interface startup frees the interface structure without canceling previously scheduled work. The pending work may then execute against freed memory, leading to kernel memory corruption or a panic. This requires IPMI hardware to be present and is triggered during interface initialization, which needs root-level access to load or reload the driver, or occurs at boot with malfunctioning BMC hardware.
Vulnerability analysis
When an IPMI interface encounters an error during startup, the error cleanup path frees the interface structure without first canceling work that was scheduled earlier in the initialization sequence. If that work item runs after the interface has been freed, it accesses deallocated memory, resulting in a use-after-free that can corrupt kernel heap state or crash the kernel. The fix ensures any pending work is synchronously canceled before the interface structure is released. The vulnerable code path is reached only during IPMI interface registration, which happens at boot when the driver probes IPMI hardware or when a privileged user loads the IPMI driver module; it requires physical IPMI/BMC hardware to be present and is not reachable from an unprivileged process or over the network.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.18.20 | 6.18.50 | 99692252b348 |
| mainline | — | 7.3-rc1 | — |
| 6.19 | 6.19.10 | 6.20 | a496c51dd325 |
| 7.2 | — | 7.2.4 | ae84a2536577 |