HIGH Introduced in 5.3
ipmi IpmbWrite Validation
CVE-2026-81007
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: validate write message length ipmb_write() read message fields before validating the length byte. A zero or short write can read uninitialized stack bytes. A length smaller than the SMBus header underflows the block write length. Require a non-empty buffer and the minimum IPMB request length. Also require the length byte plus payload before parsing the message.
02KernelScan AI Analysis
Risk summary
A local user with write access to the IPMB device can send a zero-length or short write that causes the driver to read uninitialized stack bytes or underflow a length calculation, potentially leading to information disclosure or denial of service. The vulnerability requires the IPMB driver to be loaded and the device node to be accessible.
Vulnerability analysis
The IPMB driver's write handler reads message fields from a user-supplied buffer before checking that the buffer is long enough to contain a valid IPMB request. A zero-length or overly short write causes the driver to parse uninitialized stack memory as message fields, and a length byte smaller than the SMBus header can underflow a block-write length calculation. The fix adds an explicit check that the write is non-empty and that the supplied length byte plus payload meet the minimum IPMB request size before any field parsing begins. The vulnerable path is reachable locally by any user who can open and write to the IPMB character device, which typically requires the IPMB driver module to be loaded and the corresponding device node to be present.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| mainline | 5.3 | 7.3-rc1 | 53637506884d |
| 6.18 | 5.3 | 6.18.50 | 5719431ca2b5 |
| 6.12 | 5.3 | 6.12.109 | 60939bcda6f3 |
| 6.6 | 5.3 | 6.6.157 | 7d66d54b974c |
| 5.15 | 5.3 | 5.15.221 | 94f8d20153e3 |
| 7.2 | 5.3 | 7.2.4 | a84c6e3d188f |
| 5.10 | 5.3 | 5.10.270 | 8990c7f6bfc1 |
| 6.1 | 5.3 | 6.1.188 | e527cd4e8006 |
| cip/6.12 | 5.3 | 6.12.111-cip32 | 60939bcda6f3 |