Executive brief
A vulnerability was identified in the Linux kernel's Intelligent Platform Management Interface (IPMI) driver, which is used for managing and monitoring hardware health. The flaw involves how the system tracks the number of messages sent by users, which could lead to a system crash or allow an attacker to gain unauthorized control over the system. Administrators should apply the latest kernel updates to ensure these message limits are handled safely.
Technical details
A vulnerability in `drivers/char/ipmi/ipmi_msghandler.c` within the Linux kernel was caused by improper handling of user message limits and reference counting. Specifically, the code suffered from improper counting of active messages and a use-after-free condition when processing receive messages. The fix restructures the message handling logic to centralize reference counting and limit checks within the receive message allocation routine (`ipmi_alloc_recv_msg`). This ensures that `nr_msgs` and `refcount` are managed atomically and safely, preventing premature memory deallocation. The vulnerability is reachable by local users with access to the IPMI interface.
Affected products
- Linux Linux Kernel 5.19 to 6.17.3, 6.1.156, 6.6.112, 6.12.53
Timeline
- 2025-09-05: patched: Initial fix authored by Corey Minyard
- 2025-11-12: disclosed: CVE-2025-40202 published
References
- https://git.kernel.org/stable/c/0ed73be9a2547ffb9b5c1d879ad9bfab73d920b5
- https://git.kernel.org/stable/c/348121b29594d42d1635648fd3ed31dfa25351d5
- https://git.kernel.org/stable/c/53d6e403affbf6df2c859a0ea00ccfc1e72090ca
- https://git.kernel.org/stable/c/b52da4054ee0bf9ecb44996f2c83236ff50b3812
- https://git.kernel.org/stable/c/f63723ca7d7623f9dae1990973cd158671f03c56