HIGH Introduced in 6.16
ipmi CmdRcvr UAF
CVE-2026-89486
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.7MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() Commit 9e91f8a6c868 ("ipmi:msghandler: Remove srcu for the ipmi_interfaces list") dropped the synchronize_rcu() between unlinking the command receivers from intf->cmd_rcvrs and freeing them, updating only the comment that explains why the barrier is needed. The cmd_rcvrs list is still traversed under plain RCU: find_cmd_rcvr() walks it inside rcu_read_lock(), and handle_ipmb_get_msg_cmd() borrows rcvr->user from that lookup within the same read-side section. Without the grace period, _ipmi_destroy_user() can kfree() a cmd_rcvr while a reader still holds a pointer to it, causing a use-after-free. The rework only made srcu unnecessary for the interfaces list; the cmd_rcvrs list still relies on plain RCU. Restore the synchronize_rcu() before freeing the receivers.
02KernelScan AI Analysis
Risk summary
A local user with access to the IPMI character device can trigger a use-after-free when destroying an IPMI user, racing against command-receiver lookups. This can corrupt kernel memory and potentially lead to privilege escalation or a kernel panic. Systems exposing IPMI interfaces to untrusted local processes are most at risk.
Vulnerability analysis
When an IPMI user is destroyed, the cleanup path unlinks command receivers from the interface list and then immediately frees them. However, other code paths still traverse that same list under RCU protection and may hold pointers to receivers after they have been unlinked. Without a grace period between unlinking and freeing, a concurrent reader can access a receiver that has already been freed, resulting in a use-after-free. The fix restores the missing RCU synchronization barrier so that all in-flight readers complete before any receiver memory is freed. The vulnerable path is reachable locally through the IPMI character device interface, which typically requires a user with access to the corresponding device node.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.16 | 6.18.50 | 3088e41292fe |
| 7.2 | 6.16 | 7.2.4 | 5dc0b2a9af95 |
| mainline | 6.16 | 7.3-rc1 | 05ec76cfbce6 |